| Summary: | dpkg new security issue CVE-2015-0840 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | bruno, shlomif, sysadmin-bugs |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/639968/ | ||
| Whiteboard: | has_procedure advisory MGA4-32-OK MGA4-64-OK | ||
| Source RPM: | dpkg-1.17.10-1.1.mga4.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2015-04-10 14:26:11 CEST
David Walser
2015-04-10 14:26:17 CEST
Whiteboard:
(none) =>
MGA5TOO, MGA4TOO
David Walser
2015-04-10 16:26:20 CEST
URL:
(none) =>
http://lwn.net/Vulnerabilities/639968/ Ping? In case you missed it, Anne said you may update this now: https://ml.mageia.org/l/arc/dev/2015-04/msg00383.html
David Walser
2015-05-04 23:51:19 CEST
Blocks:
(none) =>
14674 Updates pushed to both mga5/cauldron and mga4 in updates_testing Status:
NEW =>
ASSIGNED Thanks Bruno! The Mageia 4 update will need to be removed and rebuilt since you forgot to remove the subrel. I asked in #mageia-sysadm but haven't gotten a response yet. Oops sorry for that. Is that critical in fact as the next one would either be a subrel 2 or another version again ? The issue can be worked around by setting the release tag in Cauldron to 2, which you can still do as it hasn't been pushed yet. Done ! Thanks David for the hint. Patched package uploaded for Mageia 4. Updated package uploaded for Cauldron. Thanks again Bruno! Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=13279#c10 Advisory: ======================== Updated dpkg packages fix security vulnerability: The dpkg-source command in Debian dpkg before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc) (CVE-2015-0840). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0840 https://www.debian.org/security/2015/dsa-3217 ======================== Updated packages in core/updates_testing: ======================== dpkg-1.17.25-1.1.mga4 perl-Dpkg-1.17.25-1.1.mga4 from dpkg-1.17.25-1.1.mga4.src.rpm CC:
(none) =>
bruno I'm now going to test this update. Stay tuned. CC:
(none) =>
shlomif (In reply to Shlomi Fish from comment #8) > I'm now going to test this update. Stay tuned. The test procedure ran fine on an x86-64 Mageia 4 VBox VM. Adding MGA4-64-OK . Now will do MGA4-32-OK. Whiteboard:
has_procedure =>
MGA4-64-OK has_procedure (In reply to Shlomi Fish from comment #9) > (In reply to Shlomi Fish from comment #8) > > I'm now going to test this update. Stay tuned. > > The test procedure ran fine on an x86-64 Mageia 4 VBox VM. Adding MGA4-64-OK > . Now will do MGA4-32-OK. MGA4-32-OK is fine on VBox. Whiteboard:
MGA4-64-OK has_procedure =>
MGA4-64-OK has_procedure MGA4-32-OK Validating. Advisory uploaded. Please push to 4 updates Thanks! Keywords:
(none) =>
validated_update An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0197.html Status:
ASSIGNED =>
RESOLVED This also fixed CVE-2014-8625: http://lwn.net/Vulnerabilities/644272/ |