netflix/security-bulletins

Security Bulletins that relate to Netflix Open Source

Security Bulletins

Below are notifications for security and privacy events within Netflix Open Source applications.

Date	Type	Subject
May 09, 2024	Critical	Path Traversal vulnerability via File Uploads in Genie
November 09, 2023	Low	CORS check misconfiguration in the DIAL protocol
August 17, 2023	Critical	Secret Key used for signing JWT tokens exposure in Dispatch
February 28, 2023	Low	Insecure random generation in Lemur
March 30, 2022	Critical	Format String Vulnerability in ConsoleMe
March 23, 2021	Important	Local Information Disclosure in Priam
March 23, 2021	Important	Local Information Disclosure in Hollow
March 10, 2021	Important	Critical Vulnerability Exposing Private Keys in Lemur
December 08, 2020	Important	SpEL Template injection on Netflix Spinnaker
November 6, 2020	Important	Multiple Access Control Issues in Dispatch
November 6, 2020	Important	Multiple XSS Vulnerabilities in Dispatch
August 27, 2020	Important	Authenticated Server-Side Request Forgery in Orca Spinnaker
March 05, 2020	Important	Server-Side Template Injection in Netflix Titus
February 24, 2020	Important	Server-Side Template Injection in Netflix Conductor
June 20, 2019	Informational	Dial Reference code implementation has Denial of Service
January 10, 2018	Important	Unauthenticated Server-Side Request Forgery in Hystrix-Dashboard
April 14, 2017	Important	Spinnaker Orca RCE and arbitrary file and URL access
August 31, 2016	Important	zuul.filter.admin.enabled Defaults to True
June 6, 2016	Important	Heap Overflow in Dynomite YAML Configuration Parser
February 22, 2015	Important	External Entity Injection 'XXE' in Recipes-rss Open-Source Application

Below are notifications for security vulnerabilities in third-party software.

Date	Type	Subject
August 13, 2019	Important	HTTP/2 Denial of Service Advisory
June 17, 2019	Important	Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service vulnerabilities

Unfortunately we are not able to address software support issues in this repository. Please contact the upstream project instead.

security-bulletins's Issues

IPtables filter may be inefective due to placement

I believe the IP tables rule should be updated with a top insert to ensure that the packet does not get accepted prior to the appended rule and that to further ensure no issues it should be added to the mangle table which is the lead of the stack.

iptables -t mangle -I INPUT -p tcp -m tcpmss --mss 1:500 -j DROP

how to patch with centos6 ?

my os centos6 kernel is :2.6.32-504.3.3.el6.x86_64

tc-bytecode in 2019-001 may erroneously match values in tcp timestamp options?

I don't think there's anything to ensure it is not evaluating any four bytes of timestamp's eight bytes of values. Re-transmitted segments with newer TS values are less likely to also be matched erroneously (except for maybe echo values on SYN|ACKs) but the session might have to pay the initial rto penalty.

Credit on 2019-001.md

The page says: "We thank Jonathan Lemon and Alexey Kodanev for helping to improve the Linux patches."

Please amend that to:

"We thank Jonathan Lemon,. Alexey Kodanev and Joao Martins for helping to improve the Linux patches."

Alexey reported the bug. Joao found the solution.

Thank you!

PATCH_net_1_4.patch - Issue

Hi ,

In PATCH_net_1_4.patch have 5 files modifications/changes.

net/ipv4/tcp_output.c modification lines are not available in following kernel version in Centos.

Kernel versions :-
3.10.0-693.11.6.el7.x86_64
3.10.0-514.26.2.el7.x86_64
3.10.0-327.36.3.el7.x86_64

Not available lines :

@@ -2747,7 +2747,7 @@ static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
 		if (next_skb_size <= skb_availroom(skb))
 			skb_copy_bits(next_skb, 0, skb_put(skb, next_skb_size),
 				      next_skb_size);
-		else if (!skb_shift(skb, next_skb, next_skb_size))
+		else if (!tcp_skb_shift(skb, next_skb, 1, next_skb_size))
 			return false;
 	}
 	tcp_highest_sack_replace(sk, next_skb, skb);

Due to this kpatch got failed .Please check and do the needful.

Regards,
Senthil