Security update for clamav

Announcement ID:	SUSE-SU-2020:3918-1
Rating:	important
References:	bsc#1118459 bsc#1119353 bsc#1144504 bsc#1149458 bsc#1157763 bsc#1171981 bsc#1174250 bsc#1174255 jsc#ECO-3010
Cross-References:	CVE-2019-12900 CVE-2019-15961 CVE-2020-3123 CVE-2020-3327 CVE-2020-3341 CVE-2020-3350 CVE-2020-3481
CVSS scores:	CVE-2019-12900 ( SUSE ): 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12900 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12900 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-15961 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-15961 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-3123 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-3327 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-3341 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-3341 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-3350 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2020-3350 ( NVD ): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2020-3350 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2020-3481 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	HPE Helion OpenStack 8 SUSE Enterprise Storage 5 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Point of Service Image Server 12 12-SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 SUSE Linux Enterprise Server 12 SP3 ESPOS 12-SP3 SUSE Linux Enterprise Server 12 SP3 LTSS 12-SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE OpenStack Cloud 7 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9

An update that solves seven vulnerabilities, contains one feature and has one security fix can now be installed.

Description:

This update for clamav fixes the following issues:

clamav was updated to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459.

• clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort.
• Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume two times as much memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no.
• Fix clamav-milter.service (requires clamd.service to run)
• bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
• Partial sync with SLE15.

Update to version 0.102.4

Accumulated security fixes:

• CVE-2020-3350: Fix a vulnerability wherein a malicious user could replace a scan target's directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file (eg. a critical system file). The issue would affect users that use the --move or --remove options for clamscan, clamdscan, and clamonacc. (bsc#1174255)
• CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking results in an out-of-bounds read which could cause a crash. The previous fix for this CVE in 0.102.3 was incomplete. This fix correctly resolves the issue.
• CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition. Improper error handling may result in a crash due to a NULL pointer dereference. This vulnerability is mitigated for those using the official ClamAV signature databases because the file type signatures in daily.cvd will not enable the EGG archive parser in versions affected by the vulnerability. (bsc#1174250)
• CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. (bsc#1171981)
• CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash.
• CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. (bsc#1157763).
• CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458)
• CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime config option (bsc#1144504)

Update to version 0.101.3:

• ZIP bomb causes extreme CPU spikes (bsc#1144504)

Update to version 0.101.2 (bsc#1118459):

• Support for RAR v5 archive extraction.
• Incompatible changes to the arguments of cl_scandesc, cl_scandesc_callback, and cl_scanmap_callback.
• Scanning options have been converted from a single flag bit-field into a structure of multiple categorized flag bit-fields.
• The CL_SCAN_HEURISTIC_ENCRYPTED scan option was replaced by 2 new scan options: CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE, and CL_SCAN_HEURISTIC_ENCRYPTED_DOC
• Incompatible clamd.conf and command line interface changes.
• Heuristic Alerts" (aka "Algorithmic Detection") options have been changed to make the names more consistent. The original options are deprecated in 0.101, and will be removed in a future feature release.
• For details, see https://blog.clamav.net/2018/12/clamav-01010-has-been-released.html

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• HPE Helion OpenStack 8
  zypper in -t patch HPE-Helion-OpenStack-8-2020-3918=1
• SUSE OpenStack Cloud 7
  zypper in -t patch SUSE-OpenStack-Cloud-7-2020-3918=1
• SUSE OpenStack Cloud 8
  zypper in -t patch SUSE-OpenStack-Cloud-8-2020-3918=1
• SUSE OpenStack Cloud 9
  zypper in -t patch SUSE-OpenStack-Cloud-9-2020-3918=1
• SUSE OpenStack Cloud Crowbar 8
  zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-3918=1
• SUSE OpenStack Cloud Crowbar 9
  zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2020-3918=1
• SUSE Linux Enterprise Point of Service Image Server 12 12-SP2
  zypper in -t patch SUSE-SLE-POS-12-SP2-CLIENT-2020-3918=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SAP-12-SP2-2020-3918=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3
  zypper in -t patch SUSE-SLE-SAP-12-SP3-2020-3918=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SAP-12-SP4-2020-3918=1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-3918=1
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-ESPOS-2020-3918=1
• SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-3918=1
• SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2020-3918=1
• SUSE Linux Enterprise Server 12 SP3 ESPOS 12-SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-ESPOS-2020-3918=1
• SUSE Linux Enterprise Server 12 SP3 LTSS 12-SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2020-3918=1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2020-3918=1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2020-3918=1
• SUSE Enterprise Storage 5
  zypper in -t patch SUSE-Storage-5-2020-3918=1

Package List:

• HPE Helion OpenStack 8 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE OpenStack Cloud 7 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE OpenStack Cloud 8 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE OpenStack Cloud 9 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE OpenStack Cloud Crowbar 8 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE OpenStack Cloud Crowbar 9 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Point of Service Image Server 12 12-SP2 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2 (ppc64le s390x x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 (x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP3 ESPOS 12-SP3 (aarch64 x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP3 LTSS 12-SP3 (aarch64 ppc64le s390x x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1
• SUSE Enterprise Storage 5 (aarch64 x86_64)
  • clamav-0.103.0-33.32.1
  • clamav-debuginfo-0.103.0-33.32.1
  • clamav-debugsource-0.103.0-33.32.1

References:

• https://www.suse.com/security/cve/CVE-2019-12900.html
• https://www.suse.com/security/cve/CVE-2019-15961.html
• https://www.suse.com/security/cve/CVE-2020-3123.html
• https://www.suse.com/security/cve/CVE-2020-3327.html
• https://www.suse.com/security/cve/CVE-2020-3341.html
• https://www.suse.com/security/cve/CVE-2020-3350.html
• https://www.suse.com/security/cve/CVE-2020-3481.html
• https://bugzilla.suse.com/show_bug.cgi?id=1118459
• https://bugzilla.suse.com/show_bug.cgi?id=1119353
• https://bugzilla.suse.com/show_bug.cgi?id=1144504
• https://bugzilla.suse.com/show_bug.cgi?id=1149458
• https://bugzilla.suse.com/show_bug.cgi?id=1157763
• https://bugzilla.suse.com/show_bug.cgi?id=1171981
• https://bugzilla.suse.com/show_bug.cgi?id=1174250
• https://bugzilla.suse.com/show_bug.cgi?id=1174255
• https://jira.suse.com/browse/ECO-3010