Ubuntu 6286 Published by

The following three security updates are available for Ubuntu Linux:

[USN-6564-1] Node.js vulnerabilities
[USN-6566-1] SQLite vulnerabilities
[USN-6565-1] OpenSSH vulnerabilities




[USN-6564-1] Node.js vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6564-1
January 03, 2024

nodejs vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in Node.js.

Software Description:
- nodejs: An open-source, cross-platform JavaScript runtime environment.

Details:

Hubert Kario discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2022-4304)

CarpetFuzz, Dawei Wang discovered that Node.js incorrectly handled certain
inputs. If a user or an automated system were tricked into opening a specially
crafted input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-4450)

Octavio Galland and Marcel Böhme discovered that Node.js incorrectly handled
certain inputs. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-0215)

David Benjamin discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2023-0286)

Hubert Kario and Dmitry Belyavsky discovered that Node.js incorrectly handled
certain inputs. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-0401)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
libnode-dev 12.22.9~dfsg-1ubuntu3.3
libnode72 12.22.9~dfsg-1ubuntu3.3
nodejs 12.22.9~dfsg-1ubuntu3.3

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6564-1
CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286,
CVE-2023-0401

Package Information:
https://launchpad.net/ubuntu/+source/nodejs/12.22.9~dfsg-1ubuntu3.3



[USN-6566-1] SQLite vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6566-1
January 03, 2024

sqlite3 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in SQLite.

Software Description:
- sqlite3: C library that implements an SQL database engine

Details:

It was discovered that SQLite incorrectly handled certain protection
mechanisms when using a CLI script with the --safe option, contrary to
expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)

It was discovered that SQLite incorrectly handled certain memory operations
in the sessions extension. A remote attacker could possibly use this issue
to cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
libsqlite3-0 3.42.0-1ubuntu0.1

Ubuntu 23.04:
libsqlite3-0 3.40.1-1ubuntu0.1

Ubuntu 22.04 LTS:
libsqlite3-0 3.37.2-2ubuntu0.3

Ubuntu 20.04 LTS:
libsqlite3-0 3.31.1-4ubuntu0.6

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6566-1
CVE-2022-46908, CVE-2023-7104

Package Information:
https://launchpad.net/ubuntu/+source/sqlite3/3.42.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/sqlite3/3.40.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/sqlite3/3.37.2-2ubuntu0.3
https://launchpad.net/ubuntu/+source/sqlite3/3.31.1-4ubuntu0.6



[USN-6565-1] OpenSSH vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6565-1
January 03, 2024

openssh vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in OpenSSH.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

It was discovered that OpenSSH incorrectly handled supplemental groups when
running helper programs for AuthorizedKeysCommand and
AuthorizedPrincipalsCommand as a different user. An attacker could possibly
use this issue to escalate privileges. This issue only affected Ubuntu
20.04 LTS. (CVE-2021-41617)

It was discovered that OpenSSH incorrectly added destination constraints
when PKCS#11 token keys were added to ssh-agent, contrary to expectations.
This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.
(CVE-2023-51384)

It was discovered that OpenSSH incorrectly handled user names or host names
with shell metacharacters. An attacker could possibly use this issue to
perform OS command injection. (CVE-2023-51385)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
openssh-client 1:9.3p1-1ubuntu3.2
openssh-server 1:9.3p1-1ubuntu3.2

Ubuntu 23.04:
openssh-client 1:9.0p1-1ubuntu8.7
openssh-server 1:9.0p1-1ubuntu8.7

Ubuntu 22.04 LTS:
openssh-client 1:8.9p1-3ubuntu0.6
openssh-server 1:8.9p1-3ubuntu0.6

Ubuntu 20.04 LTS:
openssh-client 1:8.2p1-4ubuntu0.11
openssh-server 1:8.2p1-4ubuntu0.11

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6565-1
CVE-2021-41617, CVE-2023-51384, CVE-2023-51385

Package Information:
https://launchpad.net/ubuntu/+source/openssh/1:9.3p1-1ubuntu3.2
https://launchpad.net/ubuntu/+source/openssh/1:9.0p1-1ubuntu8.7
https://launchpad.net/ubuntu/+source/openssh/1:8.9p1-3ubuntu0.6
https://launchpad.net/ubuntu/+source/openssh/1:8.2p1-4ubuntu0.11