Sveriges mest populära poddar

Ubuntu Security Podcast

Episode 108

12 min • 19 mars 2021

Overview

This week we start preparing for 16.04 LTS to transition to Extended Security Maintenance, plus we look at security updates for OpenSSH, Python, the Linux kernel and more, as well as some currently open positions on our team.

This week in Ubuntu Security Updates

28 unique CVEs addressed

[USN-4762-1] OpenSSH vulnerability [00:54]

  • 1 CVEs addressed in Focal (20.04 LTS), Groovy (20.10)
  • Double free in ssh-agent - so only affects openssh-client and where the ssh-agent socket is able to be accessed by other users etc - on moderns systems the socket is only accessible by the owner so would need to have forwarded the ssh-agent to an attacker controlled host perhaps to be vulnerable..

[USN-4763-1] Pillow vulnerabilities [01:50]

[USN-4754-3] Python vulnerabilities [02:50]

[USN-4764-1] GLib vulnerability [04:57]

  • 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • g_file_replace() on a dangling symlink would also create the target of the symlink as an empty file (but only if did not already exist)

[USN-4876-1] Linux kernel vulnerabilities [05:49]

[USN-4877-1] Linux kernel vulnerabilities

[USN-4878-1] Linux kernel vulnerabilities

[USN-4879-1] Linux kernel vulnerabilities

  • 2 CVEs addressed in Focal (20.04 LTS), Groovy (20.10)
  • 5.8
  • Marvell wifi driver buffer overflow - could be triggered by a malicious remote device sending a overly long ad-hoc SSID value - DoS, RCE

[USN-4880-1] OpenJPEG vulnerabilities [07:00]

Goings on in Ubuntu Security Community

Preparing for 16.04 ESM transition [07:35]

Hiring [10:17]

AppArmor Security Engineer

Ubuntu Security Engineer

Security Engineer - Ubuntu

Get in contact

Kategorier
Förekommer på
00:00 -00:00