Bug 1899239 (CVE-2019-8075)

Summary:	CVE-2019-8075 flash-plugin: Same origin policy bypass leading to information disclosure
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	erack, spotrh, stransky, tpopela, yaneti
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	flash-plugin 32.0.0.207	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-20 11:28:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1719450
Bug Blocks:	1899252

Description Guilherme de Almeida Suckevicz 2020-11-18 18:23:18 UTC

An insufficient data validation flaw was found in the Flash component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=945997

References:

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html

Comment 1 Guilherme de Almeida Suckevicz 2020-11-18 18:27:28 UTC

Created chromium tracking bugs for this issue:

Affects: epel-all [bug 1899248]
Affects: fedora-all [bug 1899247]

Comment 3 Tomas Hoger 2020-11-20 10:12:34 UTC

This is actually an Adobe Flash flaw, covered by the Adobe Security Bulletin APSB19-30:

https://helpx.adobe.com/security/products/flash-player/apsb19-30.html

Same Origin Policy Bypass 	Information Disclosure  	Important 	CVE-2019-8075

This CVE was not listed in the Adobe bulletin at the time it was published, but - according to the Revisions information in the bulletin - was only added more than 3 months later.  The update for flash-plugin packages in Red Hat Enterprise Linux 6 Supplementary which provided fixed version 32.0.0.207 was released in Jun 2019 as RHSA-2019:1476:

https://access.redhat.com/errata/RHSA-2019:1476

The versions of the Chromium browser as included in Red Hat Enterprise Linux 6 Supplementary or Fedora do not include Adobe Flash and hence can not be affected by this issue.  This probably got fixed in Chrome before the version 87.0.4280.66 when the bundled Flash version was updated to a fixed Adobe version, it only did not get acknowledged in any Chrome release announcement.

Comment 4 Product Security DevOps Team 2020-11-20 11:28:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-8075