SB2023090560 - SUSE update for sccache

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Race condition (CVE-ID: CVE-2021-45710)

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to a race condition. A remote attacker can exploit the race and execute arbitrary code on the system.

2) Resource exhaustion (CVE-ID: CVE-2022-24713)

The vulnerability allows a remote attacker to perform a denial of service (ReDoS) attack.

The vulnerability exists due regex for Rust does not properly control consumption of internal resources when parsing untrusted input. A remote attacker can pass specially crafted data to the application and perform a regular expression denial of service (ReDoS) attack.

3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2022-31394)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to the library does not allow customization of the max_header_list_size method in the H2 third-party software. A remote attacker can send overly large requests to the application and perform a denial of service (DoS) attack.

4) Code Injection (CVE-ID: CVE-2023-1521)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way the server handles compile request. A local user can execute arbitrary code with the privileges of a local sccache server by preloading the code in a shared library passed to LD_PRELOAD.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2023/suse-su-20233526-1/