Bug 21863

Summary:	webmin 1.860 fixes security issues
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, smelror, sysadmin-bugs, wilcal.int
Version:	6	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA5TOO MGA5-32-OKMGA5-64-OK MGA6-32-OK MGA6-64-OK
Source RPM:	webmin-1.840-1.mga5.src.rpm	CVE:
Status comment:

Description David Walser 2017-10-14 20:25:44 CEST

Webmin 1.860 has been released on October 10, fixing security issues and bugs:
http://www.webmin.com/changes.html

Updated packages uploaded for Mageia 5, Mageia 6, and Cauldron.

Advisory:
========================

Updated webmin package fixes security vulnerabilities:

The webmin package has been updated to version 1.840, which fixes a cross-site
scripting (XSS) issue, an issue due to improper escaping in the download
module, and has other bug fixes and enhancements.  See the upstream release
announcements and change log for details.

References:
http://www.webmin.com/
http://www.webmin.com/changes.html
========================

Updated packages in core/updates_testing:
========================
webmin-1.860-1.mga5

from webmin-1.860-1.mga5.src.rpm

David Walser 2017-10-14 20:26:20 CEST

Whiteboard: (none) => MGA5TOO

Comment 1 Stig-Ørjan Smelror 2017-10-15 00:40:26 CEST

Hi.

System: MGA6 x86_64

Installed this update, started webmin with systemctl start webmin, and logged in as root on localhost:10000.

Clicking through the options, nothing popped out as wrong or faulty as far as I could see.

Cheers,
Stig

CC: (none) => smelror

Comment 2 William Kenney 2017-10-16 17:32:07 CEST

In VirtualBox, M6, Plasma, 64-bit

Package(s) under test:
webmin

default install of webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.840-1.mga6.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache/ProFTPD/SSH
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.78:10000/
Main page displays Webmin version 1.840

install webmin from updates_testing
stop and restart webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.860-1.mga6.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache/ProFTPD/SSH
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.78:10000/
Main page displays Webmin version 1.860

CC: (none) => wilcal.int

William Kenney 2017-10-16 17:32:24 CEST

Whiteboard: MGA5TOO => MGA5TOO MGA6-64-OK

Comment 3 Stig-Ørjan Smelror 2017-10-16 17:45:03 CEST

System: MGA5 x86_64, KDE, Firefox, vmware player 14.0

Installed webmin for the first time.

Packages installed
(Medie «Core Release»)
  perl-Authen-Libwrap            0.220.0      6.mga5        x86_64
  perl-Authen-PAM                0.160.0      11.mga5       x86_64
  perl-CGI                       4.40.0       5.mga5        noarch
  perl-Encode-Detect             1.10.0       11.mga5       x86_64
  perl-IO-Tty                    1.110.0      5.mga5        x86_64
  perl-Test-Deep                 0.113.0      3.mga5        noarch
  perl-Test-NoWarnings           1.40.0       5.mga5        noarch
  perl-Test-Tester               0.109.0      4.mga5        noarch
(medie «Core Updates Testing»)
  webmin                         1.860        1.mga5        noarch

Logged in to http://localhost:10000/. Was asked to proceed to https, then asked to confirm a security issue with the SSL certificate. Did that, logged in and browsed through the menus without issues.

Did the same remotely and the same procedure with http and https. Also same result.

Whiteboard: MGA5TOO MGA6-64-OK => MGA5TOO MGA6-64-OK MGA5-64-OK

Comment 4 William Kenney 2017-10-16 17:45:21 CEST

In VirtualBox, M6, Plasma, 32-bit

Package(s) under test:
webmin

default install of webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.840-1.mga6.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.79:10000/
Main page displays Webmin version 1.840

install webmin from updates_testing
stop and restart webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.860-1.mga6.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache/ProFTPD/SSH
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.79:10000/
Main page displays Webmin version 1.860

Whiteboard: MGA5TOO MGA6-64-OK MGA5-64-OK => MGA5TOO MGA6-64-OK

Comment 5 William Kenney 2017-10-16 17:46:55 CEST

This update works fine.
Testing complete for MGA6, 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push to updates.
Thanks

Whiteboard: MGA5TOO MGA6-64-OK => MGA5TOO MGA6-32-OK MGA6-64-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

William Kenney 2017-10-16 17:49:07 CEST

Keywords: validated_update => (none)

Comment 6 William Kenney 2017-10-16 18:02:13 CEST

(In reply to William Kenney from comment #5)

> This update works fine.
> Testing complete for MGA6, 32-bit & 64-bit
> Validating the update.
> Could someone from the sysadmin team push to updates.
> Thanks

Not yet!

Comment 7 William Kenney 2017-10-16 18:02:33 CEST

In VirtualBox, M5.1, Plasma, 64-bit

Package(s) under test:
webmin

default install of webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.840-1.mga5.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.80:10000/
Main page displays Webmin version 1.840

install webmin from updates_testing
stop and restart webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.860-1.mga5.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache/ProFTPD/SSH
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.80:10000/
Main page displays Webmin version 1.860

William Kenney 2017-10-16 18:03:06 CEST

Whiteboard: MGA5TOO MGA6-32-OK MGA6-64-OK => MGA5TOO MGA5-64-OK MGA6-32-OK MGA6-64-OK

Comment 8 William Kenney 2017-10-16 18:13:44 CEST

In VirtualBox, M5.1, Plasma, 32-bit

Package(s) under test:
webmin

default install of webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.840-1.mga5.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.81:10000/
Main page displays Webmin version 1.840

install webmin from updates_testing
stop and restart webmin

[root@localhost wilcal]# urpmi webmin
Package webmin-1.860-1.mga5.noarch is already installed

webmin is accessible at:
https://localhost:10000/
I can view the Hardware -> Partitions on Local Disks
I can view Servers -> Apache
I can access webmin and do the same from another M6 system on the LAN at:
https://192.168.1.81:10000/
Main page displays Webmin version 1.860

Comment 9 William Kenney 2017-10-16 18:15:05 CEST

Now we're good

Keywords: (none) => validated_update
Whiteboard: MGA5TOO MGA5-64-OK MGA6-32-OK MGA6-64-OK => MGA5TOO MGA5-32-OKMGA5-64-OK MGA6-32-OK MGA6-64-OK

Dave Hodgins 2017-10-17 03:05:47 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 10 Mageia Robot 2017-10-18 22:20:36 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2017-0376.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED