Security fix for CVE-2020-5260 and CVE-2020-11008
CVE-2020-5260 - From the upstream release notes:
With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol.
CVE-2020-11008 - From the upstream release notes:
With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted.
Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the credentials are not for a host of the attacker's choosing; instead, they are for some unspecified host (based on how the configured credential helper handles an absent "host" parameter).
The attack has been made impossible by refusing to work with under-specified credential patterns.
sudo dnf upgrade --advisory=FEDORA-2020-4e093619bb
Please login to add feedback.