Security Issues

[Brother4Life760]

Is the team aware of the 4 security bugs

***GOT REQUEST TO AUDIT SECURITY***
Currently running OPNsense 21.7.6 (amd64/OpenSSL) at Fri Dec 10 10:47:31 PST 2021
vulnxml file up-to-date
nss-3.72 is vulnerable:
  NSS -- Memory corruption
  CVE: CVE-2021-43527
  WWW: https://vuxml.FreeBSD.org/freebsd/47695a9c-5377-11ec-8be6-d4c9ef517024.html

ruby-2.7.4,1 is vulnerable:
  rubygem-date -- Regular Expression Denial of Service Vunlerability of Date Parsing Methods
  CVE: CVE-2021-41817
  WWW: https://vuxml.FreeBSD.org/freebsd/6916ea94-4628-11ec-bbe2-0800270512f4.html

  rubygem-cgi -- buffer overrun in CGI.escape_html
  CVE: CVE-2021-41816
  WWW: https://vuxml.FreeBSD.org/freebsd/2c6af5c3-4d36-11ec-a539-0800270512f4.html

  rubygem-cgi -- cookie prefix spoofing in CGI::Cookie.parse
  CVE: CVE-2021-41819
  WWW: https://vuxml.FreeBSD.org/freebsd/4548ec97-4d38-11ec-a539-0800270512f4.html

4 problem(s) in 2 installed package(s) found.
***DONE***

[chemlud]

https://forum.opnsense.org/index.php?topic=13572.msg62511#msg62511

https://forum.opnsense.org/index.php?topic=13571.msg62475#msg62475

[Brother4Life760]

Doesn't answer my question in full tho these bugs have been there for two releases now

[Greelan]

You need to relax a little

The latest OPNsense version was released on 25 November

The NSS issue was reported on 1 December - after the latest OPNsense version

The ruby issues were patched in FreeBSD on 24 November - likely too late in the build process for the latest OPNsense version to be included

It is probable they will be addressed in 21.7.7

As the links given by chemlud indicate, the security audit in OPNsense is just a service given to the user. Do you check and follow CVEs on all the operating systems you use and hassle developers about fixing them? Unlikely. At least OPNsense gives more visibility on stuff like this than probably every other system you use

[franco]

Yes, both ruby and nss will be updated with 21.7.7 next week. The relevant updates are already in the ports tree and can be rebuilt manually if necessary.


Cheers,
Franco

[fabian]

Also, the affected Ruby code is not used or not in a way it would be exploitable.

Ruby is only used as glue code between the OPNsense GUI or API and some backend processes running on OPNsense. For example as a client for the TOR management protocol.

[Brother4Life760]

okay thanks dev. I use ruby so was just curious thanks for a update. Great to see the devs are active with there members.