Bug 15794

Summary:	curl new security issue CVE-2015-3153
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Shlomi Fish <shlomif>
Status:	RESOLVED WONTFIX	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	mageia, mageia
Version:	4
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/642638/
Whiteboard:	OK
Source RPM:	curl-7.34.0-1.6.mga4.src.rpm	CVE:
Status comment:

Description David Walser 2015-04-29 18:48:38 CEST

Upstream has issued an advisory today (April 29):
http://curl.haxx.se/docs/adv_20150429.html

The issue is fixed in 7.42.1, and there is a patch available.

The patch applies cleanly in curl 7.40.0 in Cauldron.  That is committed in SVN and a freeze push has been requested.

The patch doesn't even remotely begin to apply to 7.34.0 in Mageia 4.  We'll have to wait for someone to do a backported fix.

Reproducible: 

Steps to Reproduce:

Comment 1 David Walser 2015-04-30 19:04:01 CEST

Debian and Ubuntu have issued advisories for this on April 29 and 30:
https://www.debian.org/security/2015/dsa-3240
http://www.ubuntu.com/usn/usn-2591-1/

Debian has not fixed the issue in Wheezy, nor has Ubuntu fixed it for older versions.  It appears, due to the invasive changes in 7.37.0 that the fixes rely on, Debian and Ubuntu will not be backporting fixes to versions older than that.  Indeed, Ubuntu's CVE page for this suggests just that:
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3153.html

In all likelihood, we won't be fixing this for Mageia 4 either.

URL: (none) => http://lwn.net/Vulnerabilities/642638/

Comment 2 David Walser 2015-04-30 23:57:01 CEST

curl-7.40.0-3.mga5 uploaded for Cauldron.

Sander Lepik 2015-05-03 17:16:44 CEST

CC: (none) => mageia
Hardware: i586 => All
Assignee: bugsquad => shlomif

Shlomi Fish 2015-05-07 15:40:42 CEST

Whiteboard: (none) => OK

Comment 3 Nicolas Lécureuil 2015-05-11 00:21:17 CEST

closing as wontfix for mga4 then

Status: NEW => RESOLVED
CC: (none) => mageia
Resolution: (none) => WONTFIX