{"answers":{"affected":"","exploited":"There is no known exploitation of openSUSE-SU-2021:0006-1 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"openSUSE-SU-2021:0006-1 is a vulnerability in privoxy, published on 1 Jan 2021."},"fix_prompt":"Check this codebase for openSUSE-SU-2021:0006-1 and fix it if it is affected.\n\nWhat it is: openSUSE-SU-2021:0006-1 is a vulnerability in privoxy, published on 1 Jan 2021. \nExploitation: There is no known exploitation of openSUSE-SU-2021:0006-1 in the wild and no public exploit code.\n\nAffected product: privoxy. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/openSUSE-SU-2021-0006-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2021-0006-1/index.md)","id":"openSUSE-SU-2021:0006-1","markdown":"https://insights.sbomify.com/openSUSE-SU-2021-0006-1/index.md","name":"openSUSE-SU-2021:0006-1","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for privoxy fixes the following issues:\n\nprivoxy was updated to 3.0.29:\n\n* Fixed memory leaks when a response is buffered and the buffer\n  limit is reached or Privoxy is running out of memory.\n  OVE-20201118-0001\n* Fixed a memory leak in the show-status CGI handler when\n  no action files are configured\n  OVE-20201118-0002\n* Fixed a memory leak in the show-status CGI handler when\n  no filter files are configured\n  OVE-20201118-0003\n* Fixes a memory leak when client tags are active\n  OVE-20201118-0004\n* Fixed a memory leak if multiple filters are executed\n  and the last one is skipped due to a pcre error\n  OVE-20201118-0005\n* Prevent an unlikely dereference of a NULL-pointer that\n  could result in a crash if accept-intercepted-requests\n  was enabled, Privoxy failed to get the request destination\n  from the Host header and a memory allocation failed.\n  OVE-20201118-0006\n* Fixed memory leaks in the client-tags CGI handler when\n  client tags are configured and memory allocations fail.\n  OVE-20201118-0007\n* Fixed memory leaks in the show-status CGI handler when memory\n  allocations fail\n  OVE-20201118-0008\n* Add experimental https inspection support\n* Use JIT compilation for static filtering for speedup\n* Add support for Brotli decompression, add\n  'no-brotli-accepted' filter which prevents the use of \n  Brotli compression\n* Add feature to gather exended statistics\n* Use IP_FREEBIND socket option to help with failover\n* Allow to use extended host patterns and vanilla host patterns\n  at the same time by prefixing extended host patterns with\n  'PCRE-HOST-PATTERN:'\n* Added 'Cross-origin resource sharing' (CORS) support\n* Add SOCKS5 username/password support\n* Bump the maximum number of action and filter files\n  to 100 each\n* Fixed handling of filters with 'split-large-forms 1'\n  when using the CGI editor.\n* Better detect a mismatch of connection details when\n  figuring out whether or not a connection can be reused\n* Don't send a 'Connection failure' message instead of the\n  'DNS failure' message\n* Let LOG_LEVEL_REQUEST log all requests\n* Improvements to default Action file\n\nLicense changed to GPLv3.\n\n- remove packaging vulnerability boo#1157449","ecosystems":["openSUSE:Leap 15.1","openSUSE:Leap 15.2"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security update for privoxy","id":"openSUSE-SU-2021:0006-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2021"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"openSUSE:Leap 15.1","fixed":["3.0.29-lp152.3.3.1"],"introduced":["0"],"last_affected":[],"package":"privoxy","purl":"pkg:rpm/opensuse/privoxy\u0026distro=openSUSE%20Leap%2015.1","source":"openSUSE-SU-2021:0006-1"},{"ecosystem":"openSUSE:Leap 15.2","fixed":["3.0.29-lp152.3.3.1"],"introduced":["0"],"last_affected":[],"package":"privoxy","purl":"pkg:rpm/opensuse/privoxy\u0026distro=openSUSE%20Leap%2015.2","source":"openSUSE-SU-2021:0006-1"}],"products":null,"published":"2021-01-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/openSUSE-SU-2021-0006-1/"}