USN-2698-1 SQLite Vulnerabilities


Severity

Medium

Vendor

SQLite

Versions Affected
  • Ubuntu 14.04
Description

It was discovered that SQLite incorrectly handled skip-scan optimization. An attacker could use this issue to cause applications using SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.

The Cloud Foundry project released a BOSH stemcell version 3031 and a cflinuxfs2 rootfs stack that have the patched version of OpenSSH.

Pivotal is releasing an updated version of Pivotal Cloud Foundry Suite which references this patched BOSH stemcell and patched rootfs stack.

Affected Pivotal Products and Versions

Severity is medium unless otherwise noted.

  • All versions of Cloud Foundry BOSH stemcells prior to 3031 have versions of OpenSSH vulnerable to USN-2698-1
  • All versions of Cloud Foundry cflinuxfs2 prior to 1.3.0 have versions of OpenSSH vulnerable to USN-2698-1
  • Pivotal Cloud Foundry Elastic Runtime pre-1.5.4 versions, Pivotal Ops Manager pre-1.5.5 versions, Pivotal Redis pre-1.4.8 versions, Pivotal Gemfire SSC pre-1.0.2 versions, Pivotal RabbitMQ pre-1.4.4 versions, Pivotal Ops Metrics pre-1.4.2 versions, and Pivotal MySQL pre-1.6.2 versions.
Mitigation

Users of affected versions should apply the following mitigation:

  • The Cloud Foundry project recommends that Cloud Foundry deployments run with BOSH stemcells 3031 or later versions, and cflinuxfs2 version 1.3.0 or later versions.
  • Pivotal recommends that customers upgrade to the 1.5.4 or later versions of Pivotal Cloud Foundry Elastic Runtime, 1.5.4 or later versions of Pivotal Ops Manager, 1.0.2 or later versions of Pivotal Gemfire SSC, 1.4.8 or later versions of Pivotal Redis, 1.4.4 or later versions of RabbitMQ, 1.4.2 or later versions of Pivotal Ops Metrics, and 1.6.2 or later versions of Pivotal MySQL.
Credit

Michal Zalewski

References