Bug 22054

Assigning to the registered apr-util maintainer.

CC: (none) => marja11
Assignee: bugsquad => shlomif

Hi.

Updated RPMs uploaded to updates_testing for MGA5 and MGA6.

apr-util-1.5.4-5.mga5
apr-util-1.5.4-8.mga6

Cheers,
Stig

CC: (none) => smelror

Thanks Stig-Ørjan and Shlomi.  Please remember to use subrels for stable updates.

Advisory:
========================

Updated apr-util packages fix security vulnerability:

Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the
integrity of SDBM database files used by apr_sdbm*() functions, resulting in a
possible out of bound read access. A local user with write access to the
database can make a program or process using these functions crash, and cause a
denial of service (CVE-2017-12618).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12618
http://www.apache.org/dist/apr/Announcement1.x.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3Z2STTD6D27UYP6XERSJGSCPYXEZ7KN6/
========================

Updated packages in core/updates_testing:
========================
libapr-util1_0-1.5.4-5.mga5
apr-util-dbd-ldap-1.5.4-5.mga5
apr-util-dbd-pgsql-1.5.4-5.mga5
apr-util-dbd-mysql-1.5.4-5.mga5
apr-util-dbd-sqlite3-1.5.4-5.mga5
apr-util-dbd-freetds-1.5.4-5.mga5
apr-util-dbd-odbc-1.5.4-5.mga5
apr-util-dbm-db-1.5.4-5.mga5
apr-util-openssl-1.5.4-5.mga5
apr-util-nss-1.5.4-5.mga5
libapr-util-devel-1.5.4-5.mga5
libapr-util1_0-1.5.4-8.mga6
apr-util-dbd-ldap-1.5.4-8.mga6
apr-util-dbd-pgsql-1.5.4-8.mga6
apr-util-dbd-mysql-1.5.4-8.mga6
apr-util-dbd-sqlite3-1.5.4-8.mga6
apr-util-dbd-freetds-1.5.4-8.mga6
apr-util-dbd-odbc-1.5.4-8.mga6
apr-util-dbm-db-1.5.4-8.mga6
apr-util-openssl-1.5.4-8.mga6
apr-util-nss-1.5.4-8.mga6
libapr-util-devel-1.5.4-8.mga6

from SRPMS:
apr-util-1.5.4-5.mga5.src.rpm
apr-util-1.5.4-8.mga6.src.rpm

Assignee: shlomif => qa-bugs
CC: (none) => shlomif
Summary: apr-util new security issue => apr-util new security issue CVE-2017-12618

MGA5-64 on Lenovo B50 KDE
No installation issues.
Found apache-mod-session to be dependent on apr-util-openssl
So as root at CLI:
# systemctl stop httpd
# strace -o /home/tester5/Documenten/aprutil.txt httpd
# systemctl stop httpd
The trace file shows:
open("/lib64/libaprutil-1.so.0", O_RDONLY|O_CLOEXEC) = 3
So seems OK.

CC: (none) => herman.viaene
Whiteboard: MGA5TOO => MGA5TOO MGA5-64-OK

Testing M6/64

Before the update, I only had lib64apr-util1_0-1.5.4-7.mga6 installed, so clearly need just that for normal Apache usage. I added all the apr-util- packages largely for 'clean update' testing.

After updating without issues all 10 pkgs to version 1.5.4-8.mga6, then stopping httpd, tried:
 # strace httpd 2>&1 | grep apr
 open("/lib64/libaprutil-1.so.0", O_RDONLY|O_CLOEXEC) = 3
 open("/lib64/libapr-1.so.0", O_RDONLY|O_CLOEXEC) = 3
which shows the library is used; but returned to the command prompt immediately. So re-started httpd, and am using it now.
This is a very passive OK, but for want of better... Validating, doing the advisory.

Keywords: (none) => advisory, validated_update
Whiteboard: MGA5TOO MGA5-64-OK => MGA5TOO MGA5-64-OK MGA6-64-OK
CC: (none) => lewyssmith, sysadmin-bugs

Hi,

After a fresh installation of MGA5 with apache, the "htdigest" command (included in apache rpm) doesn't work due to the lack of libapr-1.so.0 library.

After forcing the installation of libapr (urpmi libapr) all seems ok.

CC: (none) => richard

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2017-0427.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Ok for this update, but this doesn't solve the RPM dependency problem on MGA5 (all is ok on MGA6) :

urpmi apache
1 - lib64unimrcp-deps-1.1.2-6.mga5.x86_64
2 - lib64apr-util1_0-1.5.4-5.mga5.x86_64

If you chose 1 (by default), "htdigest" can't be used

rexy, please file a bug on unimrcp-deps, which should *not* be including this library.  In the fix we will probably also have to add something to prefer.vendor.list (in meta-task) to make sure apr-util gets selected first.

Thx for your answer.
I just file it there :
https://bugs.mageia.org/show_bug.cgi?id=18831