GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2021:0443-1

Vulnerability from csaf_opensuse - Published: 2021-03-18 13:06 - Updated: 2021-03-18 13:06
Summary
Security update for privoxy
Severity
Moderate
Notes
Title of the patch: Security update for privoxy
Description of the patch: This update for privoxy fixes the following issues: Update to version 3.0.32: - Security/Reliability (boo#1183129) - ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera) - cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera) - socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera) - chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera) - Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera) - Bug fixes: - Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera) - decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera). - decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment. - decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera) - gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera). - buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour 'applying zero offset to null pointer'. Reported by: Joshua Rogers (Opera) - log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera). - Respect DESTDIR when considering whether or not to install config files with '.new' extension. - OpenSSL ssl_store_cert(): Fix two error messages. - Fix a couple of format specifiers. - Silence compiler warnings when compiling with NDEBUG. - fuzz_server_header(): Fix compiler warning. - fuzz_client_header(): Fix compiler warning. - cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file. - General improvements: - Log the TLS version and the the cipher when debug 2 is enabled. - ssl_send_certificate_error(): Respect HEAD requests by not sending a body. - ssl_send_certificate_error(): End the body with a single new line. - serve(): Increase the chances that the host is logged when closing a server socket. - handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman - continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera). - decompress_iob(): Add periods to a couple of log messages - Terminate the body of the HTTP snipplets with a single new line instead of '\r\n'. - configure: Add --with-assertions option and only enable assertions when it is used - windows build: Use --with-brotli and --with-mbedtls by default and enable dynamic error checking. - gif_deanimate(): Confirm we've got an image before trying to write it Saves a pointless buf_copy() call. - OpenSSL ssl_store_cert(): Remove a superfluous space before the serial number. - Action file improvements: - Disable fast-redirects for .golem.de/ - Unblock requests to adri*. - Block requests for trc*.taboola.com/ - Disable fast-redirects for .linkedin.com/ - Filter file improvements: - Make the second pcrs job of the img-reorder filter greedy again. The ungreedy version broke the img tags on: https://bulk.fefe.de/scalability/. - Privoxy-Log-Parser: - Highlight a few more messages. - Clarify the --statistics output. The shown 'Reused connections' are server connections so name them appropriately. - Bump version to 0.9.3. - Privoxy-Regression-Test: - Add the --check-bad-ssl option to the --help output. - Bump version to 0.7.3. - Documentation: - Add pushing the created tag to the release steps in the developer manual. - Clarify that 'debug 32768' should be used in addition to the other debug directives when reporting problems. - Add a 'Third-party licenses and copyrights' section to the user manual.
Patchnames: openSUSE-2021-443
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2021-20272
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2021-20273
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2021-20272
Threats
Impact important
CVE-2021-20274
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2021-20272
Threats
Impact important
CVE-2021-20275
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2021-20272
Threats
Impact important
CVE-2021-20276
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2021-20272
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for privoxy",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for privoxy fixes the following issues:\n\nUpdate to version 3.0.32:\n\n  - Security/Reliability (boo#1183129)\n\n    - ssplit(): Remove an assertion that could be triggered with a\n      crafted CGI request.\n      Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272\n      Reported by: Joshua Rogers (Opera)\n    - cgi_send_banner(): Overrule invalid image types. Prevents a\n      crash with a crafted CGI request if Privoxy is toggled off.\n      Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273\n      Reported by: Joshua Rogers (Opera)\n    - socks5_connect(): Don\u0027t try to send credentials when none are\n      configured. Fixes a crash due to a NULL-pointer dereference\n      when the socks server misbehaves.\n      Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274\n      Reported by: Joshua Rogers (Opera)\n    - chunked_body_is_complete(): Prevent an invalid read of size\n      two.\n      Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275\n      Reported by: Joshua Rogers (Opera)\n    - Obsolete pcre: Prevent invalid memory accesses with an invalid\n      pattern passed to pcre_compile(). Note that the obsolete pcre\n      code is scheduled to be removed before the 3.0.33 release.\n      There has been a warning since 2008 already.\n      Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276\n      Reported by: Joshua Rogers (Opera)\n\n  - Bug fixes:\n\n    - Properly parse the client-tag-lifetime directive. Previously it was\n      not accepted as an obsolete hash value was being used.\n      Reported by: Joshua Rogers (Opera)\n    - decompress_iob(): Prevent reading of uninitialized data.\n      Reported by: Joshua Rogers (Opera).\n    - decompress_iob(): Don\u0027t advance cur past eod when looking\n      for the end of the file name and comment.\n    - decompress_iob(): Cast value to unsigned char before shifting.\n      Prevents a left-shift of a negative value which is undefined behaviour.\n      Reported by: Joshua Rogers (Opera)\n    - gif_deanimate(): Confirm that that we have enough data before doing\n      any work. Fixes a crash when fuzzing with an empty document.\n      Reported by: Joshua Rogers (Opera).\n    - buf_copy(): Fail if there\u0027s no data to write or nothing to do.\n      Prevents undefined behaviour \u0027applying zero offset to null pointer\u0027.\n      Reported by: Joshua Rogers (Opera)\n    - log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is\n      being used while fuzzing.\n      Reported by: Joshua Rogers (Opera).\n    - Respect DESTDIR when considering whether or not to install\n      config files with \u0027.new\u0027 extension.\n    - OpenSSL ssl_store_cert(): Fix two error messages.\n    - Fix a couple of format specifiers.\n    - Silence compiler warnings when compiling with NDEBUG.\n    - fuzz_server_header(): Fix compiler warning.\n    - fuzz_client_header(): Fix compiler warning.\n    - cgi_send_user_manual(): Also reject requests if the user-manual\n      directive specifies a https:// URL. Previously Privoxy would try and\n      fail to open a local file.\n\n  - General improvements:\n\n    - Log the TLS version and the the cipher when debug 2 is enabled.\n    - ssl_send_certificate_error(): Respect HEAD requests by not sending a body.\n    - ssl_send_certificate_error(): End the body with a single new line.\n    - serve(): Increase the chances that the host is logged when closing\n      a server socket.\n    - handle_established_connection(): Add parentheses to clarify an expression\n      Suggested by: David Binderman\n    - continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE\n      if process_encrypted_request() fails. This makes it more obvious that the\n      connection will not be reused. Previously serve() relied on\n      CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset.\n      Inspired by a patch from Joshua Rogers (Opera).\n    - decompress_iob(): Add periods to a couple of log messages\n    - Terminate the body of the HTTP snipplets with a single new line\n      instead of \u0027\\r\\n\u0027.\n    - configure: Add --with-assertions option and only enable assertions\n      when it is used\n    - windows build: Use --with-brotli and --with-mbedtls by default and\n      enable dynamic error checking.\n    - gif_deanimate(): Confirm we\u0027ve got an image before trying to write it\n      Saves a pointless buf_copy() call.\n    - OpenSSL ssl_store_cert(): Remove a superfluous space before the serial number.\n\n  - Action file improvements:\n\n    - Disable fast-redirects for .golem.de/\n    - Unblock requests to adri*.\n    - Block requests for trc*.taboola.com/\n    - Disable fast-redirects for .linkedin.com/\n\n  - Filter file improvements:\n\n    - Make the second pcrs job of the img-reorder filter greedy again.\n      The ungreedy version broke the img tags on:\n      https://bulk.fefe.de/scalability/.\n\n  - Privoxy-Log-Parser:\n\n    - Highlight a few more messages.\n    - Clarify the --statistics output. The shown \u0027Reused connections\u0027\n      are server connections so name them appropriately.\n    - Bump version to 0.9.3.\n\n  - Privoxy-Regression-Test:\n\n    - Add the --check-bad-ssl option to the --help output.\n    - Bump version to 0.7.3.\n\n  - Documentation:\n\n    - Add pushing the created tag to the release steps in the developer manual.\n    - Clarify that \u0027debug 32768\u0027 should be used in addition to the other debug\n      directives when reporting problems.\n    - Add a \u0027Third-party licenses and copyrights\u0027 section to the user manual.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-443",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0443-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0443-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TFUTCP522RHVYR5DDZPU4P3YHFZXBVYJ/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0443-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TFUTCP522RHVYR5DDZPU4P3YHFZXBVYJ/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1183129",
        "url": "https://bugzilla.suse.com/1183129"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20272 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20272/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20273 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20273/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20274 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20274/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20275 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20276 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20276/"
      }
    ],
    "title": "Security update for privoxy",
    "tracking": {
      "current_release_date": "2021-03-18T13:06:59Z",
      "generator": {
        "date": "2021-03-18T13:06:59Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0443-1",
      "initial_release_date": "2021-03-18T13:06:59Z",
      "revision_history": [
        {
          "date": "2021-03-18T13:06:59Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "privoxy-doc-3.0.32-lp152.3.9.1.noarch",
                "product": {
                  "name": "privoxy-doc-3.0.32-lp152.3.9.1.noarch",
                  "product_id": "privoxy-doc-3.0.32-lp152.3.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "privoxy-3.0.32-lp152.3.9.1.x86_64",
                "product": {
                  "name": "privoxy-3.0.32-lp152.3.9.1.x86_64",
                  "product_id": "privoxy-3.0.32-lp152.3.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "privoxy-3.0.32-lp152.3.9.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64"
        },
        "product_reference": "privoxy-3.0.32-lp152.3.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "privoxy-doc-3.0.32-lp152.3.9.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
        },
        "product_reference": "privoxy-doc-3.0.32-lp152.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20272",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20272"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading to server crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20272",
          "url": "https://www.suse.com/security/cve/CVE-2021-20272"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20272",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-18T13:06:59Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20272"
    },
    {
      "cve": "CVE-2021-20273",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20273"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20273",
          "url": "https://www.suse.com/security/cve/CVE-2021-20273"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20273",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-18T13:06:59Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20273"
    },
    {
      "cve": "CVE-2021-20274",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20274"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20274",
          "url": "https://www.suse.com/security/cve/CVE-2021-20274"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20274",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-18T13:06:59Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20274"
    },
    {
      "cve": "CVE-2021-20275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20275",
          "url": "https://www.suse.com/security/cve/CVE-2021-20275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20275",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-18T13:06:59Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20275"
    },
    {
      "cve": "CVE-2021-20276",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20276"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may lead to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20276",
          "url": "https://www.suse.com/security/cve/CVE-2021-20276"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20276",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:privoxy-3.0.32-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:privoxy-doc-3.0.32-lp152.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-18T13:06:59Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20276"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.