openSUSE-SU-2021:0016-1 Security update for privoxy
Not scored
Published
Check this codebase for openSUSE-SU-2021:0016-1 and fix it if it is affected.
What it is: openSUSE-SU-2021:0016-1 is a vulnerability in privoxy, published on 4 Jan 2021.
Exploitation: There is no known exploitation of openSUSE-SU-2021:0016-1 in the wild and no public exploit code.
Affected product: privoxy. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/openSUSE-SU-2021-0016-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2021-0016-1/index.md)
- Exploited in the wild
- Not known
- Fix
- Available
What is openSUSE-SU-2021:0016-1?
openSUSE-SU-2021:0016-1 is a vulnerability in privoxy, published on 4 Jan 2021.
Official description
This update for privoxy fixes the following issues:
privoxy was updated to 3.0.29:
- Fixed memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory. OVE-20201118-0001
- Fixed a memory leak in the show-status CGI handler when no action files are configured OVE-20201118-0002
- Fixed a memory leak in the show-status CGI handler when no filter files are configured OVE-20201118-0003
- Fixes a memory leak when client tags are active OVE-20201118-0004
- Fixed a memory leak if multiple filters are executed and the last one is skipped due to a pcre error OVE-20201118-0005
- Prevent an unlikely dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed. OVE-20201118-0006
- Fixed memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail. OVE-20201118-0007
- Fixed memory leaks in the show-status CGI handler when memory allocations fail OVE-20201118-0008
- Add experimental https inspection support
- Use JIT compilation for static filtering for speedup
- Add support for Brotli decompression, add 'no-brotli-accepted' filter which prevents the use of Brotli compression
- Add feature to gather exended statistics
- Use IP_FREEBIND socket option to help with failover
- Allow to use extended host patterns and vanilla host patterns at the same time by prefixing extended host patterns with 'PCRE-HOST-PATTERN:'
- Added 'Cross-origin resource sharing' (CORS) support
- Add SOCKS5 username/password support
- Bump the maximum number of action and filter files to 100 each
- Fixed handling of filters with 'split-large-forms 1' when using the CGI editor.
- Better detect a mismatch of connection details when figuring out whether or not a connection can be reused
- Don't send a 'Connection failure' message instead of the 'DNS failure' message
- Let LOG_LEVEL_REQUEST log all requests
- Improvements to default Action file
License changed to GPLv3.
- remove packaging vulnerability boo#1157449
This update was imported from the openSUSE:Leap:15.1:Update update project.
Which versions are affected by openSUSE-SU-2021:0016-1?
Linux distribution packages (1)
privoxy SUSE:Package Hub 15 SP1 | All versions | 3.0.29-bp151.3.3.1 |
How do I fix openSUSE-SU-2021:0016-1?
Upgrade to a fixed version.
Is openSUSE-SU-2021:0016-1 being exploited?
There is no known exploitation of openSUSE-SU-2021:0016-1 in the wild and no public exploit code.