SB2021080309 - Multiple vulnerabilities in Pengutronix barebox

Description

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2021-37848)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to strncmp is used during hash comparison in the "common/password.c". A remote attacker can gain unauthorized access to sensitive information on the system.

2) Information disclosure (CVE-ID: CVE-2021-37847)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the use of memcmp during digest verification in the "crypto/digest.c". A remote attacker can gain unauthorized access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://github.com/saschahauer/barebox/commit/a3337563c705bc8e0cf32f910b3e9e3c43d962ff
• https://github.com/saschahauer/barebox/commit/0a9f9a7410681e55362f8311537ebc7be9ad0fbe