Bug 13811

Summary:	[CVE 21] squirrel 3.0.7 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	RESOLVED INVALID	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	blocker
Priority:	Highest	CC:	a.proklov, e.kosachev, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	y.tumanov: secteam_verified+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2021-41556,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-10-18 20:06:20 MSK

Please patch CVEs for package squirrel version 3.0.7
  
INFO (CVEs are): squirrel 3.0.7
 cves found
CVE-2021-41556
Desc: sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-41556
Severity: CRITICAL

Comment 1 Vladimir Potapov 2023-10-20 11:41:30 MSK

*** Bug 13943 has been marked as a duplicate of this bug. ***

Comment 2 Aleksandr Proklov 2023-10-22 03:43:40 MSK

Проект в контрибе во всех платформах. Обновил в контрибе до версии 3.2.

QA проверка не требуется, Юрий убирает флаг secteam сам.

Comment 3 Yury 2023-10-27 17:49:56 MSK

secteam_verified