OPENSUSE-SU-2019:1779-1

Vulnerability from csaf_opensuse - Published: 2019-07-21 05:39 - Updated: 2019-07-21 05:39
Summary
Security update for ledger

Notes

Title of the patch
Security update for ledger
Description of the patch
This update for ledger fixes the following issues: ledger was updated to 3.1.3: + Properly reject postings with a comment right after the flag (bug #1753) + Make sorting order of lot information deterministic (bug #1747) + Fix bug in tag value parsing (bug #1702) + Remove the org command, which was always a hack to begin with (bug #1706) + Provide Docker information in README + Various small documentation improvements This also includes the update to 3.1.2: + Increase maximum length for regex from 255 to 4095 (bug #981) + Initialize periods from from/since clause rather than earliest transaction date (bug #1159) + Check balance assertions against the amount after the posting (bug #1147) + Allow balance assertions with multiple posts to same account (bug #1187) + Fix period duration of 'every X days' and similar statements (bug #370) + Make option --force-color not require --color anymore (bug #1109) + Add quoted_rfc4180 to allow CVS output with RFC 4180 compliant quoting. + Add support for --prepend-format in accounts command + Fix handling of edge cases in trim function (bug #520) + Fix auto xact posts not getting applied to account total during journal parse (bug #552) + Transfer null_post flags to generated postings + Fix segfault when using --market with --group-by + Use amount_width variable for budget report + Keep pending items in budgets until the last day they apply + Fix bug where .total used in value expressions breaks totals + Make automated transactions work with assertions (bug #1127) + Improve parsing of date tokens (bug #1626) + Don't attempt to invert a value if it's already zero (bug #1703) + Do not parse user-specified init-file twice + Fix parsing issue of effective dates (bug #1722, TALOS-2017-0303, CVE-2017-2807) + Fix use-after-free issue with deferred postings (bug #1723, TALOS-2017-0304, CVE-2017-2808) + Fix possible stack overflow in option parsing routine (bug #1222, CVE-2017-12481) + Fix possible stack overflow in date parsing routine (bug #1224, CVE-2017-12482) + Fix use-after-free when using --gain (bug #541) + Python: Removed double quotes from Unicode values. + Python: Ensure that parse errors produce useful RuntimeErrors + Python: Expose journal expand_aliases + Python: Expose journal_t::register_account + Improve bash completion + Emacs Lisp files have been moved to https://github.com/ledger/ledger-mode + Various documentation improvements
Patchnames
openSUSE-2019-1779
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for ledger",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for ledger fixes the following issues:\n\nledger was updated to 3.1.3:\n\n+ Properly reject postings with a comment right after the flag (bug #1753)\n+ Make sorting order of lot information deterministic (bug #1747)\n+ Fix bug in tag value parsing (bug #1702)\n+ Remove the org command, which was always a hack to begin with (bug #1706)\n+ Provide Docker information in README\n+ Various small documentation improvements \n\nThis also includes the update to 3.1.2:\n\n+ Increase maximum length for regex from 255 to 4095 (bug #981)\n+ Initialize periods from from/since clause rather than earliest \n  transaction date (bug #1159)\n+ Check balance assertions against the amount after the posting (bug #1147)\n+ Allow balance assertions with multiple posts to same account (bug #1187)\n+ Fix period duration of \u0027every X days\u0027 and similar statements (bug #370)\n+ Make option --force-color not require --color anymore (bug #1109)\n+ Add quoted_rfc4180 to allow CVS output with RFC 4180 compliant quoting.\n+ Add support for --prepend-format in accounts command\n+ Fix handling of edge cases in trim function (bug #520)\n+ Fix auto xact posts not getting applied to account total during \n  journal parse (bug #552)\n+ Transfer null_post flags to generated postings\n+ Fix segfault when using --market with --group-by\n+ Use amount_width variable for budget report\n+ Keep pending items in budgets until the last day they apply\n+ Fix bug where .total used in value expressions breaks totals\n+ Make automated transactions work with assertions (bug #1127)\n+ Improve parsing of date tokens (bug #1626)\n+ Don\u0027t attempt to invert a value if it\u0027s already zero (bug #1703)\n+ Do not parse user-specified init-file twice\n+ Fix parsing issue of effective dates \n  (bug #1722, TALOS-2017-0303, CVE-2017-2807)\n+ Fix use-after-free issue with deferred postings \n  (bug #1723, TALOS-2017-0304, CVE-2017-2808)\n+ Fix possible stack overflow in option parsing routine \n  (bug #1222, CVE-2017-12481)\n+ Fix possible stack overflow in date parsing routine \n  (bug #1224, CVE-2017-12482)\n+ Fix use-after-free when using --gain (bug #541)\n+ Python: Removed double quotes from Unicode values.\n+ Python: Ensure that parse errors produce useful RuntimeErrors\n+ Python: Expose journal expand_aliases\n+ Python: Expose journal_t::register_account\n+ Improve bash completion\n+ Emacs Lisp files have been moved to https://github.com/ledger/ledger-mode\n+ Various documentation improvements\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2019-1779",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1779-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2019:1779-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YSPDVC274T4T34MJVEXTDY2YYV5NIYUC/#YSPDVC274T4T34MJVEXTDY2YYV5NIYUC"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2019:1779-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YSPDVC274T4T34MJVEXTDY2YYV5NIYUC/#YSPDVC274T4T34MJVEXTDY2YYV5NIYUC"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052478",
        "url": "https://bugzilla.suse.com/1052478"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052484",
        "url": "https://bugzilla.suse.com/1052484"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1105084",
        "url": "https://bugzilla.suse.com/1105084"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-12481 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-12481/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-12482 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-12482/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-2807 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-2807/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-2808 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-2808/"
      }
    ],
    "title": "Security update for ledger",
    "tracking": {
      "current_release_date": "2019-07-21T05:39:40Z",
      "generator": {
        "date": "2019-07-21T05:39:40Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2019:1779-1",
      "initial_release_date": "2019-07-21T05:39:40Z",
      "revision_history": [
        {
          "date": "2019-07-21T05:39:40Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ledger-3.1.3-lp151.3.3.1.x86_64",
                "product": {
                  "name": "ledger-3.1.3-lp151.3.3.1.x86_64",
                  "product_id": "ledger-3.1.3-lp151.3.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.0",
                "product": {
                  "name": "openSUSE Leap 15.0",
                  "product_id": "openSUSE Leap 15.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ledger-3.1.3-lp151.3.3.1.x86_64 as component of openSUSE Leap 15.0",
          "product_id": "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64"
        },
        "product_reference": "ledger-3.1.3-lp151.3.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ledger-3.1.3-lp151.3.3.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
        },
        "product_reference": "ledger-3.1.3-lp151.3.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-12481",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-12481"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-12481",
          "url": "https://www.suse.com/security/cve/CVE-2017-12481"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052484 for CVE-2017-12481",
          "url": "https://bugzilla.suse.com/1052484"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-21T05:39:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-12481"
    },
    {
      "cve": "CVE-2017-12482",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-12482"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-12482",
          "url": "https://www.suse.com/security/cve/CVE-2017-12482"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052478 for CVE-2017-12482",
          "url": "https://bugzilla.suse.com/1052478"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052484 for CVE-2017-12482",
          "url": "https://bugzilla.suse.com/1052484"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-21T05:39:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-12482"
    },
    {
      "cve": "CVE-2017-2807",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-2807"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-2807",
          "url": "https://www.suse.com/security/cve/CVE-2017-2807"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052484 for CVE-2017-2807",
          "url": "https://bugzilla.suse.com/1052484"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-21T05:39:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-2807"
    },
    {
      "cve": "CVE-2017-2808",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-2808"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
          "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-2808",
          "url": "https://www.suse.com/security/cve/CVE-2017-2808"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052484 for CVE-2017-2808",
          "url": "https://bugzilla.suse.com/1052484"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.0:ledger-3.1.3-lp151.3.3.1.x86_64",
            "openSUSE Leap 15.1:ledger-3.1.3-lp151.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-07-21T05:39:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-2808"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.