libsass: CVE-2017-11608

Debian Bug report logs - #870186
libsass: CVE-2017-11608

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libsass: CVE-2017-11608

Date: Sun, 30 Jul 2017 21:55:27 +0200

Source: libsass
Version: 3.4.3-1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for libsass.

CVE-2017-11608[0]:
| There is a heap-based buffer over-read in the
| Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A
| crafted input will lead to a remote denial of service attack.

Can you please double-check this report and possibly report it
upstream.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11608
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11608
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1474276

Regards,
Salvatore

Message #10 received at 870186-done@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <jonas@jones.dk>

To: 870186-done@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: [Pkg-sass-devel] Bug#870186: libsass: CVE-2017-11608

Date: Mon, 11 Mar 2019 13:43:41 +0100

[Message part 1 (text/plain, inline)]

control: tags -1 unreproducible

Quoting Salvatore Bonaccorso (2017-07-30 21:55:27)
> the following vulnerability was published for libsass.
> 
> CVE-2017-11608[0]:
> | There is a heap-based buffer over-read in the
> | Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A
> | crafted input will lead to a remote denial of service attack.
> 
> Can you please double-check this report and possibly report it
> upstream.
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2017-11608
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11608
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1474276

This bug does not affect any release of libsass in Debian.

POC on Debian stretch with libsass1 3.4.3-1 and sassc 3.4.2-1:

Internal Error: Invalid UTF-8

POC on Debian stretch with libsass1 3.4.3-1 and sassc 3.4.2-1:

Error: Invalid UTF-8 sequence
        on line 1 of /attachment.cgi?id=1303540
>> "�d\
   -^


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 870186@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <jonas@jones.dk>

To: 870186@bugs.debian.org

Subject: Re: [Pkg-sass-devel] Bug#870186: libsass: CVE-2017-11608

Date: Mon, 11 Mar 2019 13:49:36 +0100

[Message part 1 (text/plain, inline)]

Quoting Jonas Smedegaard (2019-03-11 13:43:41)
> POC on Debian stretch with libsass1 3.4.3-1 and sassc 3.4.2-1:
> 
> Error: Invalid UTF-8 sequence
>         on line 1 of /attachment.cgi?id=1303540
> >> "�d\
>    -^

Correction: Aboce was with libsass1 3.5.5-2 and sassc 3.5.0-1.

 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 870186@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Jonas Smedegaard <jonas@jones.dk>, 870186@bugs.debian.org

Subject: Re: Bug#870186: [Pkg-sass-devel] Bug#870186: libsass: CVE-2017-11608

Date: Mon, 11 Mar 2019 17:14:31 +0100

Control: fixed -1 3.4.6-1

Hi,

On Mon, Mar 11, 2019 at 01:49:36PM +0100, Jonas Smedegaard wrote:
> Quoting Jonas Smedegaard (2019-03-11 13:43:41)
> > POC on Debian stretch with libsass1 3.4.3-1 and sassc 3.4.2-1:
> > 
> > Error: Invalid UTF-8 sequence
> >         on line 1 of /attachment.cgi?id=1303540
> > >> "�d\
> >    -^
> 
> Correction: Aboce was with libsass1 3.5.5-2 and sassc 3.5.0-1.

Did you build with ASAN to verify?

The issue should be fixed with
https://github.com/sass/libsass/commit/648f763ede97f9a2c2c843a0a18ac18bbde3507b
which was in 3.4.6 (so indeed the issue does not affect anymore
sid/buster which included the above commit with the 3.4.6-1 upload).

Regards,
Salvatore

Message #27 received at 870186@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 870186@bugs.debian.org

Subject: Re: Bug#870186: libsass: CVE-2017-11608

Date: Mon, 11 Mar 2019 17:22:38 +0100

[Message part 1 (text/plain, inline)]

Contol: tags -1 - unreproducible

Hi,

Actually running under valgrind shows the invalid read of size 1 under
stretch. But the issue is fixed in the sid version already.

Regards,
Salvatore

[valgrind.log.xz (application/x-xz, attachment)]

Message #32 received at 870186@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <jonas@jones.dk>

To: 870186@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: [Pkg-sass-devel] Bug#870186: Bug#870186: libsass: CVE-2017-11608

Date: Mon, 11 Mar 2019 17:47:56 +0100

[Message part 1 (text/plain, inline)]

Quoting Salvatore Bonaccorso (2019-03-11 17:14:31)
> Control: fixed -1 3.4.6-1
> 
> Hi,
> 
> On Mon, Mar 11, 2019 at 01:49:36PM +0100, Jonas Smedegaard wrote:
> > Quoting Jonas Smedegaard (2019-03-11 13:43:41)
> > > POC on Debian stretch with libsass1 3.4.3-1 and sassc 3.4.2-1:
> > > 
> > > Error: Invalid UTF-8 sequence
> > >         on line 1 of /attachment.cgi?id=1303540
> > > >> "�d\
> > >    -^
> > 
> > Correction: Aboce was with libsass1 3.5.5-2 and sassc 3.5.0-1.
> 
> Did you build with ASAN to verify?
> 
> The issue should be fixed with
> https://github.com/sass/libsass/commit/648f763ede97f9a2c2c843a0a18ac18bbde3507b
> which was in 3.4.6 (so indeed the issue does not affect anymore
> sid/buster which included the above commit with the 3.4.6-1 upload).

No, I simply tested with official packaged code.

I have stopped working on the other security bugs against libsass, 
because I realize I lack the needed skills. :-(


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.