Re: ClamAV 0.103.5 and 0.104.2 security patch release; 0.102 past EOL
Jaspal Singh Sandhu via clamav-users <[email protected]> Thu, 13 Jan 2022 11:01:24 -0800
| Newsgroups | gmane.comp.security.virus.clamav.user,gmane.comp.security.virus.clamav.devel |
|---|---|
| Message-ID | <CANKMAuzXvTgQ-eubF-zK-CPLKWjNaFmO=QGPfOgpsoxTOodbsg@mail.gmail.com> |
--===============7930803403043585409== Content-Type: multipart/alternative; boundary="000000000000cb2a5905d57b5065" --000000000000cb2a5905d57b5065 Content-Type: text/plain; charset="UTF-8" Awesome On Thu, Jan 13, 2022 at 10:31 AM Micah Snyder (micasnyd) <[email protected]> wrote: > Hi Jaspal, > > There was an issue with the release steps and the Docker image was missed > yesterday. > It has been fixed and the 0.104.2 image is now up on Docker Hub. > > 0.104.2: > https://registry.hub.docker.com/layers/clamav/clamav/0.104.2/images/sha256-7177e1771bd696f9ff5acb97221107ab7d8961b1ab3b370cd1e24bf66cf02fe1?context=explore > > 0.104.2_base: > https://registry.hub.docker.com/layers/clamav/clamav/0.104.2_base/images/sha256-8aea3e0f684f50402bd10456045eb3a3ad2772ecda99739100da9345b068e25c?context=explore > > The 0.104 / 0.104_base and latest / latest_base tags also point to the > same 0.104.2 and 0.104.2_base images. > > Thanks for pointing out the issue! Please reach out again if there is > anything else. > > Regards, > Micah > > Micah Snyder > ClamAV Development > Talos > Cisco Systems, Inc. > ------------------------------ > *From:* Jaspal Singh Sandhu <[email protected]> > *Sent:* Thursday, January 13, 2022 9:13 AM > *To:* ClamAV users ML <[email protected]> > *Cc:* ClamAV Announcements ML <[email protected]>; ClamAV > Development <[email protected]>; Micah Snyder (micasnyd) < > [email protected]> > *Subject:* Re: [clamav-users] ClamAV 0.103.5 and 0.104.2 security patch > release; 0.102 past EOL > > Hi, > > We are using Docker Image for 1.104 version at Roberthalf Is that image > updated too with this patch? > Thanks, > > Jaspal Sandhu > > > On Wed, Jan 12, 2022 at 12:13 PM Micah Snyder (micasnyd) via clamav-users < > [email protected]> wrote: > > Find this announcement online at: > https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html > > > ClamAV versions 0.103.5 and 0.104.2 are now available for download on the clamav.net > Downloads page <https://www.clamav.net/downloads>. > > > We would also like to take this opportunity to remind users that versions > 0.102 and 0.101 have reached their end-of-life period. *These versions > exceeded our EOL dates on Jan. 3, 2022 and will soon be actively blocked > from downloading signature database updates.* > > > For additional details about ClamAV's end-of-life policy, please see our > online documentation <https://docs.clamav.net/faq/faq-eol.html>. > > > 0.103.5 > > ClamAV 0.103.5 is a critical patch release with the following fixes: > > - > > CVE-2022-20698 > <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20698>: Fix > for invalid pointer read that may cause a crash. This issue affects > 0.104.1, 0.103.4 and prior when ClamAV is compiled with libjson-c and the > CL_SCAN_GENERAL_COLLECT_METADATA scan option (the clamscan --gen-json > option) is enabled. > > Cisco would like to thank Laurent Delosieres of ManoMano for reporting > this vulnerability. > - > > Fixed ability to disable the file size limit with libclamav C API, > like this: > > cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0); > > This issue didn't affect ClamD or ClamScan which also can disable the > limit by setting it to zero using MaxFileSize 0 in clamd.conf for > ClamD, or clamscan --max-filesize=0 for ClamScan. > > Note: Internally, the max file size is still set to 2 GiB. Disabling > the limit for a scan will fall back on the internal 2 GiB limitation. > - > > Increased the maximum line length for ClamAV config files from 512 > bytes to 1,024 bytes to allow for longer config option strings. > - > > SigTool: Fix insufficient buffer size for --list-sigs that caused a > failure when listing a database containing one or more very long > signatures. This fix was backported from 0.104. > > Special thanks to the following for code contributions and bug reports: > > - Laurent Delosieres > > 0.104.2 > > ClamAV 0.104.2 is a critical patch release with the following fixes: > > - > > CVE-2022-20698 > <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20698>: Fix > for invalid pointer read that may cause a crash. Affects 0.104.1, 0.103.4 > and prior when ClamAV is compiled with libjson-c and the > CL_SCAN_GENERAL_COLLECT_METADATA scan option (the clamscan --gen-json > option) is enabled. > > Cisco would like to thank Laurent Delosieres of ManoMano for reporting > this vulnerability. > - > > Fixed ability to disable the file size limit with libclamav C API, > like this: > > cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0); > > This issue didn't impact ClamD or ClamScan which also can disable the > limit by setting it to zero using MaxFileSize 0 in clamd.conf for > ClamD, or clamscan --max-filesize=0 for ClamScan. > > Note: Internally, the max file size is still set to 2 GiB. Disabling > the limit for a scan will fall back on the internal 2 GiB limitation. > - > > Increased the maximum line length for ClamAV config files from 512 > bytes to 1,024 bytes to allow for longer config option strings. > > Special thanks to the following for code contributions and bug reports: > > - Laurent Delosieres > > > > Micah Snyder > ClamAV Development > Talos > Cisco Systems, Inc. > > _______________________________________________ > > clamav-users mailing list > [email protected] > https://lists.clamav.net/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml > > -- Thanks, Jaspal Sandhu --000000000000cb2a5905d57b5065 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">Awesome</div><div><br><div class=3D"gmail_quote"><div dir= =3D"ltr" class=3D"gmail_attr">On Thu, Jan 13, 2022 at 10:31 AM Micah Snyder= (micasnyd) <<a href=3D"mailto:[email protected]">[email protected]</a= >> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0= 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div dir=3D"ltr"> <div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Hi Jaspal,</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> There was an issue with the release steps and the Docker image was missed y= esterday.=C2=A0 <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> It has been fixed and the 0.104.2 image is now up on Docker Hub.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> 0.104.2: <a href=3D"https://registry.hub.docker.com/layers/clamav/clamav/0.= 104.2/images/sha256-7177e1771bd696f9ff5acb97221107ab7d8961b1ab3b370cd1e24bf= 66cf02fe1?context=3Dexplore" id=3D"m_-6150980735292340407LPlnk852975" targe= t=3D"_blank"> https://registry.hub.docker.com/layers/clamav/clamav/0.104.2/images/sha256-= 7177e1771bd696f9ff5acb97221107ab7d8961b1ab3b370cd1e24bf66cf02fe1?context=3D= explore</a><br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> 0.104.2_base: <a href=3D"https://registry.hub.docker.com/layers/clamav/clam= av/0.104.2_base/images/sha256-8aea3e0f684f50402bd10456045eb3a3ad2772ecda997= 39100da9345b068e25c?context=3Dexplore" id=3D"m_-6150980735292340407LPlnk827= 368" target=3D"_blank"> https://registry.hub.docker.com/layers/clamav/clamav/0.104.2_base/images/sh= a256-8aea3e0f684f50402bd10456045eb3a3ad2772ecda99739100da9345b068e25c?conte= xt=3Dexplore</a><br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> The 0.104 / 0.104_base and latest / latest_base tags also point to the same= 0.104.2 and 0.104.2_base images.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Thanks for pointing out the issue!=C2=A0 Please reach out again if there=C2= =A0is anything else.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Regards,</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Micah<br> </div> <div id=3D"m_-6150980735292340407Signature"> <div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text-a= lign:start"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline!important">Micah Snyder</span><br style=3D"font= -family:Helvetica;font-size:12px;font-weight:normal;text-align:start"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline!important">ClamAV Development</span><br style= =3D"font-family:Helvetica;font-size:12px;font-weight:normal;text-align:star= t"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline!important">Talos</span><br style=3D"font-family= :Helvetica;font-size:12px;font-weight:normal;text-align:start"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline!important">Cisco Systems, Inc.</span><br> </div> </div> </div> </div> <div id=3D"m_-6150980735292340407appendonsend"></div> <hr style=3D"display:inline-block;width:98%"> <div id=3D"m_-6150980735292340407divRplyFwdMsg" dir=3D"ltr"><font face=3D"C= alibri, sans-serif" style=3D"font-size:11pt" color=3D"#000000"><b>From:</b>= Jaspal Singh Sandhu <<a href=3D"mailto:[email protected]" target=3D= "_blank">[email protected]</a>><br> <b>Sent:</b> Thursday, January 13, 2022 9:13 AM<br> <b>To:</b> ClamAV users ML <<a href=3D"mailto:[email protected].= net" target=3D"_blank">[email protected]</a>><br> <b>Cc:</b> ClamAV Announcements ML <<a href=3D"mailto:clamav-announce@li= sts.clamav.net" target=3D"_blank">[email protected]</a>>;= ClamAV Development <<a href=3D"mailto:[email protected]" ta= rget=3D"_blank">[email protected]</a>>; Micah Snyder (micasn= yd) <<a href=3D"mailto:[email protected]" target=3D"_blank">micasnyd@ci= sco.com</a>><br> <b>Subject:</b> Re: [clamav-users] ClamAV 0.103.5 and 0.104.2 security patc= h release; 0.102 past EOL</font> <div>=C2=A0</div> </div> <div> <div dir=3D"ltr">Hi, <div><br> </div> <div>We are using Docker Image for 1.104 version at Roberthalf =C2=A0Is tha= t image updated too with this patch?<br clear=3D"all"> <div> <div dir=3D"ltr"> <div dir=3D"ltr"> <div> <div dir=3D"ltr"> <div>Thanks,<br> <br> Jaspal =C2=A0Sandhu<br> </div> </div> </div> </div> </div> </div> <br> </div> </div> <br> <div> <div dir=3D"ltr">On Wed, Jan 12, 2022 at 12:13 PM Micah Snyder (micasnyd) v= ia clamav-users <<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>> wrote:<br> </div> <blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-= left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"> <div dir=3D"ltr"> <div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <h3> <div><span style=3D"font-weight:normal;font-size:12pt">Find this announceme= nt online at: <a href=3D"https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-= patch.html" id=3D"m_-6150980735292340407x_gmail-m_7360486812644520886LPNoLP= OWALinkPreview" target=3D"_blank"> https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html<= /a><br> </span></div> </h3> <div> <p><br> </p> <p>ClamAV versions 0.103.5 and 0.104.2 are now available for download on th= e <a href=3D"https://www.clamav.net/downloads" rel=3D"nofollow" target=3D"_= blank"> clamav.net Downloads page</a>.=C2=A0</p> <p><br> </p> <p>We would also like to take this opportunity to remind users that version= s 0.102 and 0.101 have reached their end-of-life period.=C2=A0<b>These vers= ions exceeded our EOL dates on Jan. 3, 2022 and will soon be actively block= ed from downloading signature database updates.</b></p> <p><br> </p> <p>For additional details about ClamAV's end-of-life policy, <a href=3D= "https://docs.clamav.net/faq/faq-eol.html" rel=3D"nofollow" target=3D"_blan= k"> please see our online documentation</a>.</p> <span><a></a></span> <p><br> </p> <h2 dir=3D"auto">0.103.5</h2> <p dir=3D"auto">ClamAV 0.103.5 is a critical patch release with the followi= ng fixes:</p> <ul dir=3D"auto"> <li> <p><a href=3D"https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2022-206= 98" rel=3D"nofollow noreferrer noopener" target=3D"_blank">CVE-2022-20698</= a>: Fix for invalid pointer read that may cause a crash. This issue affects= 0.104.1, 0.103.4 and prior when ClamAV is compiled with libjson-c and the <code>CL_SCAN_GENERAL_COLLECT_METADATA<= /code> scan option (the <code>clamscan --gen-json</code> option) is enabled.</p> <p>Cisco would like to thank Laurent Delosieres of ManoMano for reporting t= his vulnerability.</p> </li><li> <p>Fixed ability to disable the file size limit with libclamav C API, like = this:</p> <pre lang=3D"c"><code><span lang=3D"c">=C2=A0 <span>cl_engine_set_num</span= ><span>(</span><span>engine</span><span>,</span>=C2=A0<span>CL_ENGINE_MAX_F= ILESIZE</span><span>,</span>=C2=A0<span>0</span><span>);</span></span></cod= e></pre> <p>This issue didn't affect ClamD or ClamScan which also can disable th= e limit by setting it to zero using <code>MaxFileSize 0</code> in <code>clamd.conf</code> for ClamD, or <code>c= lamscan --max-filesize=3D0</code> for ClamScan.</p> <p>Note: Internally, the max file size is still set to 2 GiB. Disabling the= limit for a scan will fall back on the internal 2 GiB limitation.</p> </li><li> <p>Increased the maximum line length for ClamAV config files from 512 bytes= to 1,024 bytes to allow for longer config option strings.</p> </li><li> <p>SigTool: Fix insufficient buffer size for <code>--list-sigs</code> that = caused a failure when listing a database containing one or more very long s= ignatures. This fix was backported from 0.104.</p> </li></ul> <p dir=3D"auto">Special thanks to the following for code contributions and = bug reports:</p> <ul dir=3D"auto"> <li>Laurent Delosieres</li></ul> <h2 dir=3D"auto">0.104.2</h2> <p dir=3D"auto">ClamAV 0.104.2 is a critical patch release with the followi= ng fixes:</p> <ul dir=3D"auto"> <li> <p><a href=3D"https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2022-206= 98" rel=3D"nofollow noreferrer noopener" target=3D"_blank">CVE-2022-20698</= a>: Fix for invalid pointer read that may cause a crash. Affects 0.104.1, 0= .103.4 and prior when ClamAV is compiled with libjson-c and the <code>CL_SCAN_GENERAL_COLLECT_METADATA</code> scan = option (the <code>clamscan --gen-json</code> option) is enabled.</p> <p>Cisco would like to thank Laurent Delosieres of ManoMano for reporting t= his vulnerability.</p> </li><li> <p>Fixed ability to disable the file size limit with libclamav C API, like = this:</p> <pre lang=3D"c"><code><span lang=3D"c">=C2=A0 <span>cl_engine_set_num</span= ><span>(</span><span>engine</span><span>,</span>=C2=A0<span>CL_ENGINE_MAX_F= ILESIZE</span><span>,</span>=C2=A0<span>0</span><span>);</span></span></cod= e></pre> <p>This issue didn't impact ClamD or ClamScan which also can disable th= e limit by setting it to zero using <code>MaxFileSize 0</code> in <code>clamd.conf</code> for ClamD, or <code>c= lamscan --max-filesize=3D0</code> for ClamScan.</p> <p>Note: Internally, the max file size is still set to 2 GiB. Disabling the= limit for a scan will fall back on the internal 2 GiB limitation.</p> </li><li> <p>Increased the maximum line length for ClamAV config files from 512 bytes= to 1,024 bytes to allow for longer config option strings.</p> </li></ul> <p dir=3D"auto">Special thanks to the following for code contributions and = bug reports:</p> <ul dir=3D"auto"> <li>Laurent Delosieres</li></ul> <div style=3D"clear:both"></div> </div> <br> </div> <div id=3D"m_-6150980735292340407x_gmail-m_7360486812644520886Signature"> <div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text-a= lign:start"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline">Micah Snyder</span><br style=3D"font-family:He= lvetica;font-size:12px;font-weight:normal;text-align:start"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline">ClamAV Development</span><br style=3D"font-fam= ily:Helvetica;font-size:12px;font-weight:normal;text-align:start"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline">Talos</span><br style=3D"font-family:Helvetica= ;font-size:12px;font-weight:normal;text-align:start"> <span style=3D"font-family:Helvetica;font-size:12px;font-weight:normal;text= -align:start;display:inline">Cisco Systems, Inc.</span><br> </div> </div> </div> </div> </div> <br> _______________________________________________<br> <br> clamav-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">clamav-u= [email protected]</a><br> <a href=3D"https://lists.clamav.net/mailman/listinfo/clamav-users" rel=3D"n= oreferrer" target=3D"_blank">https://lists.clamav.net/mailman/listinfo/clam= av-users</a><br> <br> <br> Help us build a comprehensive ClamAV guide:<br> <a href=3D"https://github.com/vrtadmin/clamav-faq" rel=3D"noreferrer" targe= t=3D"_blank">https://github.com/vrtadmin/clamav-faq</a><br> <br> <a href=3D"http://www.clamav.net/contact.html#ml" rel=3D"noreferrer" target= =3D"_blank">http://www.clamav.net/contact.html#ml</a><br> </blockquote> </div> </div> </div> </blockquote></div></div>-- <br><div dir=3D"ltr" class=3D"gmail_signature" = data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><= div>Thanks,<br><br>Jaspal =C2=A0Sandhu<br></div></div></div></div></div> --000000000000cb2a5905d57b5065-- --===============7930803403043585409== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ clamav-users mailing list [email protected] https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml --===============7930803403043585409==--