Bug 21435

Summary:	apache-commons-email new security issue CVE-2017-9801
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	geiger.david68210, herman.viaene, lewyssmith, mageia, sysadmin-bugs, tarazed25, wilcal.int
Version:	6	Keywords:	validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA5TOO MGA5-32-OK MGA5-64-OK MGA6-32-OK MGA6-64-OK advisory
Source RPM:	apache-commons-email-1.3.1-10.mga6.src.rpm	CVE:
Status comment:

Description David Walser 2017-08-02 04:09:26 CEST

Upstream has issued an advisory today (August 1):
http://openwall.com/lists/oss-security/2017/08/01/7

The issue is fixed upstream in 1.5.

Mageia 5 and Mageia 6 are also affected.

David Walser 2017-08-02 04:09:37 CEST

Whiteboard: (none) => MGA6TOO, MGA5TOO
CC: (none) => geiger.david68210

Comment 1 Nicolas Lécureuil 2017-08-10 22:55:42 CEST

pushed in updates_testing for mageia6
src.rpm:
        apache-commons-email-1.3.1-10.1.mga6

Comment 2 Nicolas Lécureuil 2017-08-10 23:02:52 CEST

pushed in updates_testing for mageia5
src.rpm:
        apache-commons-email-1.3.1-4.1.mga5

Assignee: mageia => qa-bugs

Comment 3 David Walser 2017-08-10 23:20:59 CEST

Not successfully built in Mageia 5 yet, but it is fixed in Cauldron now.

Version: Cauldron => 6
Whiteboard: MGA6TOO, MGA5TOO => MGA5TOO
Assignee: qa-bugs => mageia
CC: (none) => qa-bugs

Comment 4 Nicolas Lécureuil 2017-08-10 23:40:06 CEST

build OK now

Assignee: mageia => qa-bugs

Comment 5 David Walser 2017-08-10 23:51:25 CEST

Advisory:
========================

Updated apache-commons-email packages fix security vulnerability:

In apache-commons-email before 1.5, when a call-site passes a subject for an
email that contains line-breaks, the caller can add arbitrary SMTP headers
(CVE-2017-9801).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9801
http://openwall.com/lists/oss-security/2017/08/01/7
========================

Updated packages in core/updates_testing:
========================
apache-commons-email-1.3.1-4.1.mga5
apache-commons-email-javadoc-1.3.1-4.1.mga5
apache-commons-email-1.3.1-10.1.mga6
apache-commons-email-javadoc-1.3.1-10.1.mga6

from SRPMS:
apache-commons-email-1.3.1-4.1.mga5.src.rpm
apache-commons-email-1.3.1-10.1.mga6.src.rpm

CC: qa-bugs => mageia

Comment 6 Herman Viaene 2017-08-18 13:51:36 CEST

MGA5-32 on Asus A6000VM Xfce.
No installation issues.
Found example how to test this at https://commons.apache.org/proper/commons-email/userguide.html , but running this is beyond me. I suppose this is java, but using javac on it gives me all errors like:
apachemail.java:3: error: class, interface, or enum expected
Email email = new SimpleEmail();

CC: (none) => herman.viaene

Comment 7 Len Lawrence 2017-08-18 21:53:50 CEST

Brave of you to tackle this Herman.  Java requires a lot of commitment if you are not familiar with it.  The last time I tried anything similar it required nearly a week's work and the very kind coaching of a Java expert on the mailing list.  Those snippets would need some kind of jacket to work I think.  Beyond me also.

No PoC available so you would be best to simply pass this as installable.

Thanks, and please leave some updates for the rest of us ;-)

CC: (none) => tarazed25

Herman Viaene 2017-08-25 11:30:00 CEST

Whiteboard: MGA5TOO => MGA5TOO MGA5-32-OK

Lewis Smith 2017-08-27 20:53:03 CEST

Whiteboard: MGA5TOO MGA5-32-OK => MGA5TOO MGA5-32-OK advisory
CC: (none) => lewyssmith

Comment 8 William Kenney 2017-09-01 22:18:52 CEST

In VirtualBox, M6, Mate, 32-bit

Package(s) under test:
apache-commons-email apache-commons-email-javadoc

default install of apache-commons-email & apache-commons-email-javadoc

[root@localhost wilcal]# urpmi apache-commons-email
Package apache-commons-email-1.3.1-10.mga6.noarch is already installed
[root@localhost wilcal]# urpmi apache-commons-email-javadoc
Package apache-commons-email-javadoc-1.3.1-10.mga6.noarch is already installed

apache-commons-email installs without error

install apache-commons-email & apache-commons-email-javadoc from updates_testing

[root@localhost wilcal]# urpmi apache-commons-email
Package apache-commons-email-1.3.1-10.1.mga6.noarch is already installed
[root@localhost wilcal]# urpmi apache-commons-email-javadoc
Package apache-commons-email-javadoc-1.3.1-10.1.mga6.noarch is already installed

Packages install and update without error

CC: (none) => wilcal.int
Whiteboard: MGA5TOO MGA5-32-OK advisory => MGA5TOO MGA5-32-OK MGA6-32-OK advisory

Comment 9 William Kenney 2017-09-01 22:30:31 CEST

In VirtualBox, M6, Mate, 64-bit

Package(s) under test:
apache-commons-email apache-commons-email-javadoc

default install of apache-commons-email & apache-commons-email-javadoc

[root@localhost wilcal]# urpmi apache-commons-email
Package apache-commons-email-1.3.1-10.mga6.noarch is already installed
[root@localhost wilcal]# urpmi apache-commons-email-javadoc
Package apache-commons-email-javadoc-1.3.1-10.mga6.noarch is already installed

apache-commons-email installs without error

install apache-commons-email & apache-commons-email-javadoc from updates_testing

[root@localhost wilcal]# urpmi apache-commons-email
Package apache-commons-email-1.3.1-10.1.mga6.noarch is already installed
[root@localhost wilcal]# urpmi apache-commons-email-javadoc
Package apache-commons-email-javadoc-1.3.1-10.1.mga6.noarch is already installed

Packages install and update without error

William Kenney 2017-09-01 22:30:49 CEST

Whiteboard: MGA5TOO MGA5-32-OK MGA6-32-OK advisory => MGA5TOO MGA5-32-OK MGA6-32-OK MGA6-64-OK advisory

Comment 10 William Kenney 2017-09-01 22:48:08 CEST

In VirtualBox, M5.1, KDE, 64-bit

Package(s) under test:
apache-commons-email apache-commons-email-javadoc

default install of apache-commons-email & apache-commons-email-javadoc

[root@localhost wilcal]# urpmi apache-commons-email
Package apache-commons-email-1.3.1-4.mga5.noarch is already installed
[root@localhost wilcal]# urpmi apache-commons-email-javadoc
Package apache-commons-email-javadoc-1.3.1-4.mga5.noarch is already installed

apache-commons-email installs without error

install apache-commons-email & apache-commons-email-javadoc from updates_testing

[root@localhost wilcal]# urpmi apache-commons-email
Package apache-commons-email-1.3.1-4.1.mga5.noarch is already installed
[root@localhost wilcal]# urpmi apache-commons-email-javadoc
Package apache-commons-email-javadoc-1.3.1-4.1.mga5.noarch is already installed

Packages install and update without error

William Kenney 2017-09-01 22:48:29 CEST

Whiteboard: MGA5TOO MGA5-32-OK MGA6-32-OK MGA6-64-OK advisory => MGA5TOO MGA5-32-OK MGA5-64-OK MGA6-32-OK MGA6-64-OK advisory

Comment 11 William Kenney 2017-09-01 22:49:30 CEST

This update works fine.
Testing complete for MGA5 & MGA6, 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push to updates.
Thanks

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 12 Mageia Robot 2017-09-01 23:11:25 CEST

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0322.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED