| Summary: | castor new security issue CVE-2014-3004 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | herman.viaene, mageia, pterjan, sysadmin-bugs |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/603009/ | ||
| Whiteboard: | has_procedure advisory MGA4-32-OK MGA4-64-OK | ||
| Source RPM: | castor-1.3.2-10.mga4.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2014-06-20 16:44:26 CEST
David Walser
2014-06-20 16:44:35 CEST
Whiteboard:
(none) =>
MGA4TOO, MGA3TOO
David Walser
2014-06-20 18:54:09 CEST
URL:
(none) =>
http://lwn.net/Vulnerabilities/603009/ (In reply to David Walser from comment #0) > The issue is fixed upstream in 1.3.2. Whoops, I meant 1.3.3. The patch OpenSuSE added for 0.9.5 doesn't look forward-portable to 1.3.2. Fedora has yet to address this issue, so I guess we'll wait for them. Fedora has finally updated to 1.3.3 to fix this: https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146246.html Blocks:
(none) =>
14674 Removing Mageia 3 from the whiteboard due to EOL. I've checked the update into Mageia 4 and Cauldron SVN. It needs to be submitted (and hopefully it can be built). CC:
(none) =>
pterjan It looks like it needs some of the removed packages (in Cauldron) to build; at least apache-poi that I noticed. That'll need to resynced with Fedora before it's re-imported to fix the issues in Bug 14128. apache-poi has indeed been resynced with Fedora in SVN. Sophie says it isn't in Cauldron, but I tried to submit it to Cauldron and mgarepo/youri says that it's already there. Things are still in progress restoring things in cauldron but it should be there. I hope to finish to building eclipse-* in the next few hours (almost there) then I'll have a look. Updated packages uploaded for Mageia 4 and Cauldron. Verifying that the updated packages install cleanly is sufficient for testing this update. Advisory: ======================== Updated castor packages fix security vulnerability: The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document (CVE-2014-3004). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3004 https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146246.html ======================== Updated package in core/updates_testing: ======================== castor-1.3.3-1.mga4 castor-javadoc-1.3.3-1.mga4 from castor-1.3.3-1.mga4.src.rpm Whiteboard:
MGA4TOO =>
(none) MGA4-64 on HP Probook 6555b Version castor-1.3.3-1.mga4 installs without problems pver existing version 1.3.2, castor-javadoc-1.3.3-1.mga4 also OK (did not exist before). Whiteboard:
(none) =>
MGA4-64-OK MGA4-32 on Acer D620 Xfce Version castor-1.3.3-1.mga4 installs without problems pver existing version 1.3.2, castor-javadoc-1.3.3-1.mga4 also OK (did not exist before). Whiteboard:
MGA4-64-OK =>
MGA4-32-OK MGA4-64-OK Validating. Advisory uploaded. Please push to updates Thanks CC:
(none) =>
sysadmin-bugs An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2014-0556.html Status:
NEW =>
RESOLVED
David Walser
2014-12-31 13:36:05 CET
Blocks:
14674 =>
(none) |