Vulnerability in bzr - Security Update
Summary
DLA-1107-1: bzr - security update. Affects bzr versions < 2.6.0~bzr6526-1+deb7u1. Fixed in 2.6.0~bzr6526-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bazaar (bzr) is a version control system designed to help track changes to files over time. It is commonly used for collaborative software development. The package bundles SSL certificate checking code from Python, which had a bug that could lead to a denial of service attack. Additionally, host names in 'bzr+ssh' URLs were not parsed correctly, allowing remote attackers to execute arbitrary code by tricking users into visiting maliciously crafted URLs.
Vulnerability Detail
The first vulnerability, identified as CVE-2013-2099, arises from a bug in the SSL certificate checking code used by Bazaar. This bug could be exploited by an attacker to consume excessive resources through the use of multiple wildcards in certificate hostnames, leading to a denial of service attack.
The second vulnerability, known as CVE-2017-14176, stems from the incorrect parsing of host names in 'bzr+ssh' URLs. This flaw enables remote attackers to execute arbitrary code by enticing users to click on specially crafted URLs.
Both vulnerabilities pose significant security risks and should be addressed promptly.
How To Fix
Minimum fixed version
2.6.0~bzr6526-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bzrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerabilities in bzr pose significant security risks and should be addressed by upgrading to the fixed version. Failure to do so may result in denial of service attacks or the execution of arbitrary code by remote attackers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bzr →
FAQ
Bazaar, also known as bzr, is a version control system used for tracking changes to files over time. It is commonly used in collaborative software development projects.
CVE-2013-2099 can lead to a denial of service attack by consuming excessive resources through the use of multiple wildcards in SSL certificate hostnames.
CVE-2017-14176 allows remote attackers to execute arbitrary code by tricking users into visiting maliciously crafted 'bzr+ssh' URLs.
To fix these vulnerabilities, you should upgrade the bzr package to version 2.6.0~bzr6526-1+deb7u1 or later. Follow the standard package update procedures for your operating system.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for bzr.
