| Summary: | libtasn1 new security issues CVE-2017-10790 and CVE-2018-6003 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | davidwhodgins, herman.viaene, marja11, sysadmin-bugs |
| Version: | 6 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA6-64-OK | ||
| Source RPM: | libtasn1-4.12-1.mga6.src.rpm | CVE: | |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 22484 | ||
| Attachments: |
assign.asn1
pkix.asn |
||
|
Description
David Walser
2018-01-26 05:22:43 CET
David Walser
2018-01-26 05:22:51 CET
Whiteboard:
(none) =>
MGA6TOO CVE-2018-6003 was fixed in 4.13. Fedora has issued an advisory for this on January 23: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SV667U5M7I5UJQFCA7UOSEE4AKKYRA64/ Assigning to all packagers collectively, since there is no registered maintainer for this package. CC:
(none) =>
marja11
David Walser
2018-01-28 22:29:35 CET
Blocks:
(none) =>
22484 Updated packages uploaded for Mageia 6 and Cauldron. Advisory: ======================== Updated libtasn1 packages fix security vulnerabilities: It was discovered that Libtasn1 incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a denial of service (CVE-2017-10790). It was discovered that Libtasn1 incorrectly handled certain inputs. An attacker could possibly use this to cause Libtasn1 to hang, resulting in a denial of service (CVE-2018-6003). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10790 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6003 https://usn.ubuntu.com/usn/usn-3547-1/ ======================== Updated packages in core/updates_testing: ======================== libtasn1_6-4.13-1.mga6 libtasn1-tools-4.13-1.mga6 libtasn1-devel-4.13-1.mga6 from libtasn1-4.13-1.mga6.src.rpm Assignee:
pkg-bugs =>
qa-bugs Created attachment 9960 [details]
pkix.asn
MGA6-64 on Lenovo B50 Plasma No installation issues Rerun test as per bug 20931 Comment 6: same results: OK Added test files in attachment, so next time I don't have to follow the whole thread again. Whiteboard:
(none) =>
MGA6-64-OK Advisory committed to svn. Validating the update. Keywords:
(none) =>
advisory, validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0121.html Resolution:
(none) =>
FIXED |