Ubuntu 6537 Published by

The following two updates are available for Ubuntu Linux:

[USN-6559-1] ZooKeeper vulnerabilities
[USN-6588-1] PAM vulnerability




[USN-6559-1] ZooKeeper vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6559-1
January 16, 2024

zookeeper vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in ZooKeeper.

Software Description:
- zookeeper: High-performance coordination service for distributed applications

Details:

It was discovered that ZooKeeper incorrectly handled authorization for
the getACL() command. A remote attacker could possibly use this issue to
obtain sensitive information. This issue only affected Ubuntu 14.04
LTS and Ubuntu 16.04 LTS. (CVE-2019-0201)

Damien Diederen discovered that ZooKeeper incorrectly handled
authorization if SASL Quorum Peer authentication is enabled. An
attacker could possibly use this issue to bypass ZooKeeper's
authorization system. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04
and Ubuntu 23.10. (CVE-2023-44981)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
libzookeeper-java 3.8.0-11ubuntu0.1

Ubuntu 23.04:
libzookeeper-java 3.8.0-10ubuntu0.1

Ubuntu 22.04 LTS:
libzookeeper-java 3.4.13-6ubuntu4.1

Ubuntu 20.04 LTS:
libzookeeper-java 3.4.13-5ubuntu0.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libzookeeper-java 3.4.13-3ubuntu0.1~esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libzookeeper-java 3.4.8-1ubuntu0.1~esm2

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libzookeeper-java 3.4.5+dfsg-1ubuntu0.1~esm3

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6559-1
CVE-2019-0201, CVE-2023-44981

Package Information:
https://launchpad.net/ubuntu/+source/zookeeper/3.8.0-11ubuntu0.1
https://launchpad.net/ubuntu/+source/zookeeper/3.8.0-10ubuntu0.1
https://launchpad.net/ubuntu/+source/zookeeper/3.4.13-6ubuntu4.1
https://launchpad.net/ubuntu/+source/zookeeper/3.4.13-5ubuntu0.1



[USN-6588-1] PAM vulnerability


==========================================================================
Ubuntu Security Notice USN-6588-1
January 17, 2024

pam vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

PAM could be made to stop responding if it opened a specially crafted file.

Software Description:
- pam: Pluggable Authentication Modules

Details:

Matthias Gerstner discovered that the PAM pam_namespace module incorrectly
handled special files when performing directory checks. A local attacker
could possibly use this issue to cause PAM to stop responding, resulting in
a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
libpam-modules 1.5.2-6ubuntu1.1

Ubuntu 23.04:
libpam-modules 1.5.2-5ubuntu1.1

Ubuntu 22.04 LTS:
libpam-modules 1.4.0-11ubuntu2.4

Ubuntu 20.04 LTS:
libpam-modules 1.3.1-5ubuntu4.7

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6588-1
CVE-2024-22365

Package Information:
https://launchpad.net/ubuntu/+source/pam/1.5.2-6ubuntu1.1
https://launchpad.net/ubuntu/+source/pam/1.5.2-5ubuntu1.1
https://launchpad.net/ubuntu/+source/pam/1.4.0-11ubuntu2.4
https://launchpad.net/ubuntu/+source/pam/1.3.1-5ubuntu4.7