1193951 – (CVE-2020-21913) VUL-0: CVE-2020-21913: icu: Use after free in pkg_createWithAssemblyCode function in tools/pkgdata/pkgdata.cpp

Bug 1193951 (CVE-2020-21913) - VUL-0: CVE-2020-21913: icu: Use after free in pkg_createWithAssemblyCode function in tools/pkgdata/pkgdata.cpp

Summary: VUL-0: CVE-2020-21913: icu: Use after free in pkg_createWithAssemblyCode func...

Status:	RESOLVED FIXED

Alias:	CVE-2020-21913

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/310436/
Whiteboard:	CVSSv3.1:SUSE:CVE-2020-21913:5.5:(AV:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2021-12-21 10:04 UTC by Carlos López
Modified:	2023-10-30 20:30 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Carlos López 2021-12-21 10:04:00 UTC

rh#2006950

International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2006950
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-21913
http://www.debian.org/security/-1/dsa-5014
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-21913
https://github.com/unicode-org/icu/pull/886
http://www.cvedetails.com/cve/CVE-2020-21913/
https://unicode-org.atlassian.net/browse/ICU-20850

Comment 1 Carlos López 2021-12-21 10:04:57 UTC

Affected codestreams:
 - SUSE:SLE-12:Update
 - SUSE:SLE-15:Update
 - SUSE:SLE-15-SP2:Update

Also affected on openSUSE:
 - openSUSE:Factory

Upstream patch:
https://github.com/unicode-org/icu/commit/727505bddab0bfd527f1db6697cb4d4f7febe4a9

Comment 2 Jan Engelhardt 2021-12-21 10:09:01 UTC

$ git describe --contains 727505bddab0bfd527f1db6697cb4d4f7febe4a9
release-66-preview~24

We have icu-70 in openSUSE:Factory, so that one should be fine already.

Comment 3 Carlos López 2021-12-21 10:16:51 UTC

(In reply to Jan Engelhardt from comment #2)
> $ git describe --contains 727505bddab0bfd527f1db6697cb4d4f7febe4a9
> release-66-preview~24
> 
> We have icu-70 in openSUSE:Factory, so that one should be fine already.

You are right, my apologies!

Comment 8 Swamp Workflow Management 2022-09-07 13:26:08 UTC

SUSE-SU-2022:3141-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1193951
CVE References: CVE-2020-21913
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    icu-60.2-150000.3.12.1
openSUSE Leap 15.3 (src):    icu-60.2-150000.3.12.1
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    icu-60.2-150000.3.12.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    icu-60.2-150000.3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Swamp Workflow Management 2022-09-07 13:29:26 UTC

SUSE-SU-2022:3140-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1193951
CVE References: CVE-2020-21913
JIRA References: 
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    icu-52.1-8.13.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    icu-52.1-8.13.1
SUSE Linux Enterprise Server 12-SP5 (src):    icu-52.1-8.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2022-09-07 16:21:51 UTC

SUSE-SU-2022:3142-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1193951
CVE References: CVE-2020-21913
JIRA References: 
Sources used:
openSUSE Leap Micro 5.2 (src):    icu-65.1-150200.4.5.1
openSUSE Leap 15.4 (src):    icu-65.1-150200.4.5.1
openSUSE Leap 15.3 (src):    icu-65.1-150200.4.5.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src):    icu-65.1-150200.4.5.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    icu-65.1-150200.4.5.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    icu-65.1-150200.4.5.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    icu-65.1-150200.4.5.1
SUSE Linux Enterprise Micro 5.2 (src):    icu-65.1-150200.4.5.1
SUSE Linux Enterprise Micro 5.1 (src):    icu-65.1-150200.4.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Carlos López 2023-04-14 10:42:24 UTC

Done, closing.

Comment 13 Maintenance Automation 2023-09-08 16:30:06 UTC

SUSE-SU-2023:3563-1: An update that solves two vulnerabilities, contains two features and has 16 security fixes can now be installed.

Category: security (moderate)
Bug References: 1030253, 1095425, 1103893, 1112183, 1146907, 1158955, 1159131, 1161007, 1162882, 1166844, 1167603, 1182252, 1182645, 1192935, 1193951, 354372, 437293, 824262
CVE References: CVE-2020-10531, CVE-2020-21913
Jira References: PED-4917, SLE-11118
Sources used:
SUSE Manager Retail Branch Server 4.2 (src): icu73_2-73.2-150000.1.3.1
SUSE Manager Server 4.2 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.1 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.2 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): icu73_2-73.2-150000.1.3.1
openSUSE Leap 15.4 (src): icu73_2-73.2-150000.1.3.1
openSUSE Leap 15.5 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.3 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.4 (src): icu73_2-73.2-150000.1.3.1
Basesystem Module 15-SP4 (src): icu73_2-73.2-150000.1.3.1
Basesystem Module 15-SP5 (src): icu73_2-73.2-150000.1.3.1
SUSE Manager Proxy 4.2 (src): icu73_2-73.2-150000.1.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 Maintenance Automation 2023-10-23 20:30:05 UTC

SUSE-SU-2023:3563-2: An update that solves two vulnerabilities, contains two features and has 16 security fixes can now be installed.

Category: security (moderate)
Bug References: 1030253, 1095425, 1103893, 1112183, 1146907, 1158955, 1159131, 1161007, 1162882, 1166844, 1167603, 1182252, 1182645, 1192935, 1193951, 354372, 437293, 824262
CVE References: CVE-2020-10531, CVE-2020-21913
Jira References: PED-4917, SLE-11118
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): icu73_2-73.2-150000.1.3.1
SUSE Enterprise Storage 7.1 (src): icu73_2-73.2-150000.1.3.1
SUSE Enterprise Storage 7 (src): icu73_2-73.2-150000.1.3.1
SUSE CaaS Platform 4.0 (src): icu73_2-73.2-150000.1.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Maintenance Automation 2023-10-30 20:30:05 UTC

SUSE-SU-2023:3563-3: An update that solves two vulnerabilities, contains two features and has 16 security fixes can now be installed.

Category: security (moderate)
Bug References: 1030253, 1095425, 1103893, 1112183, 1146907, 1158955, 1159131, 1161007, 1162882, 1166844, 1167603, 1182252, 1182645, 1192935, 1193951, 354372, 437293, 824262
CVE References: CVE-2020-10531, CVE-2020-21913
Jira References: PED-4917, SLE-11118
Sources used:
SUSE Manager Retail Branch Server 4.2 (src): icu73_2-73.2-150000.1.3.1
SUSE Manager Server 4.2 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.1 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.2 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): icu73_2-73.2-150000.1.3.1
openSUSE Leap Micro 5.2 (src): icu73_2-73.2-150000.1.3.1
openSUSE Leap Micro 5.3 (src): icu73_2-73.2-150000.1.3.1
openSUSE Leap Micro 5.4 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.3 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): icu73_2-73.2-150000.1.3.1
SUSE Linux Enterprise Micro 5.4 (src): icu73_2-73.2-150000.1.3.1
Basesystem Module 15-SP4 (src): icu73_2-73.2-150000.1.3.1
Basesystem Module 15-SP5 (src): icu73_2-73.2-150000.1.3.1
SUSE Manager Proxy 4.2 (src): icu73_2-73.2-150000.1.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.