| Summary: | abrt new security issues (CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870, CVE-2015-3147, CVE-2015-3150, CVE-2015-3151, CVE-2015-3159) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | Shlomi Fish <shlomif> |
| Status: | RESOLVED OLD | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | mageia |
| Version: | 4 | ||
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/647748/ | ||
| Whiteboard: | |||
| Source RPM: | abrt-2.2.2-6.mga5.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2015-04-15 18:23:31 CEST
David Walser
2015-04-15 18:23:39 CEST
Whiteboard:
(none) =>
MGA5TOO, MGA4TOO This has been assigned CVE-2015-3315: http://openwall.com/lists/oss-security/2015/04/16/12 Summary:
abrt new security issues =>
abrt new security issues (CVE-2015-3315) More details on abrt issues (including links to RedHat bugs): http://openwall.com/lists/oss-security/2015/04/17/5 Additional CVEs have been assigned: CVE-2015-3142 CVE-2015-1869 CVE-2015-1870 CVE-2015-3147 Summary:
abrt new security issues (CVE-2015-3315) =>
abrt new security issues (CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870, CVE-2015-3147)
Sander Lepik
2015-04-18 21:54:17 CEST
CC:
(none) =>
mageia More links and info about the abrt issues: http://openwall.com/lists/oss-security/2015/04/23/26 CVE-2015-3150 and CVE-2015-3151 have been assigned to two of the issues. Summary:
abrt new security issues (CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870, CVE-2015-3147) =>
abrt new security issues (CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870, CVE-2015-3147, CVE-2015-3150, CVE-2015-3151) An additional issue, CVE-2015-3159, was identified: http://openwall.com/lists/oss-security/2015/05/05/10 Proposed fixes for all of the issues are now available. Summary:
abrt new security issues (CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870, CVE-2015-3147, CVE-2015-3150, CVE-2015-3151) =>
abrt new security issues (CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870, CVE-2015-3147, CVE-2015-3150, CVE-2015-3151, CVE-2015-3159) OK, an update on my progress. The patches in the pull request do not apply cleanly against the version of abrt in our repository (And they seem to be against a non-released GitHub branch). Backporting them seems like a huge chore. I don't know what to do. Yeah I thought that might be an issue. Probably at least we'll have to wait for Fedora to issue some updates and see what they do. We might end up just having to update it to a newer version(s). Any progress? It's on its 4th warning now.. (In reply to Sander Lepik from comment #8) > Any progress? It's on its 4th warning now.. Are there any new releases with the fixes? It would be hard to progress without them. Looking at Red Hat's bug report it doesn't seem that many changes to apply them manually. A more important question. Are we even using this package or do we need it? (In reply to Sander Lepik from comment #10) > A more important question. Are we even using this package or do we need it? Unless there's time to drop it from Mageia 5 still (I don't think there is), that's not really a more important question. If anyone is running this service they're vulnerable to trivial local privilege escalation, so we need to fix it. (In reply to Shlomi Fish from comment #9) > (In reply to Sander Lepik from comment #8) > > Any progress? It's on its 4th warning now.. > > Are there any new releases with the fixes? It would be hard to progress > without them. There aren't yet, and I agree. These issues are serious, but vetted fixes are not yet available AFAIK. RedHat has issued an advisory for this on June 9: https://rhn.redhat.com/errata/RHSA-2015-1083.html URL:
(none) =>
http://lwn.net/Vulnerabilities/647748/ Dropped from Cauldron before the Mageia 5 release. Version:
Cauldron =>
4 Fedora has issued an advisory for this for Fedora 21, their oldest supported version: https://lists.fedoraproject.org/pipermail/package-announce/2015-June/161247.html RedHat has issued an advisory for this today (July 7): https://rhn.redhat.com/errata/RHSA-2015-1210.html As that's a slightly older 2.0 release of abrt than we have in Mageia 4, maybe the patches they used there would work for us. With only a couple of weeks remaining in Mageia 4's lifetime, we don't have time to fix this and test it. This package has been dropped and no longer exists in Mageia as of Mageia 5. Closing this as OLD. Status:
ASSIGNED =>
RESOLVED |