Bug 24481

Summary:	hiawatha new security issue CVE-2019-8358
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, marja11, mhrambo3501, smelror, sysadmin-bugs, tarazed25
Version:	6	Keywords:	advisory, has_procedure, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA6-64-OK
Source RPM:	hiawatha-10.8.1-3.mga7.src.rpm	CVE:
Status comment:	Fixed upstream in 10.8.4

Description David Walser 2019-03-08 22:16:11 CET

openSUSE has issued an advisory on March 6:
https://lists.opensuse.org/opensuse-updates/2019-03/msg00022.html

The issue is fixed upstream in 10.8.4.

Mageia 6 is also affected.

David Walser 2019-03-08 22:16:17 CET

Whiteboard: (none) => MGA6TOO

David Walser 2019-03-09 02:25:00 CET

CC: (none) => smelror

Comment 1 Marja Van Waes 2019-03-09 07:44:22 CET

Assigning to all packagers collectively, since there is no registered maintainer for this package.

CC: (none) => marja11
Assignee: bugsquad => pkg-bugs

David Walser 2019-03-09 17:34:22 CET

Status comment: (none) => Fixed upstream in 10.8.4

Comment 2 Mike Rambo 2019-03-12 19:51:20 CET

Updated package uploaded for cauldron and Mageia 6.

Advisory:
========================

Updated hiawatha package fixes security vulnerability:

Verison 10.8.4 fixed a vulnerability which allowed a remote atacker to
perform directory traversal when AllowDotFiles was enabled (CVE-2019-8358).


References:
https://lists.opensuse.org/opensuse-updates/2019-03/msg00022.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8358
========================

Updated packages in core/updates_testing:
========================
hiawatha-10.8.4-1.mga6

from hiawatha-10.8.4-1.mga6.src.rpm

Link to test procedure: https://bugs.mageia.org/show_bug.cgi?id=15391#c17

Keywords: (none) => has_procedure
CC: (none) => mrambo
Version: Cauldron => 6
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA6TOO => (none)

Comment 3 Len Lawrence 2019-03-12 23:58:13 CET

mga6, x86_64

Updated hiawatha, stopped apache, enabled and started hiawatha.
$ systemctl status hiawatha
● hiawatha.service - Hiawatha Web Server
   Loaded: loaded (/usr/lib/systemd/system/hiawatha.service; enabled; vendor pre
   Active: active (running) since Tue 2019-03-12 22:31:57 GMT; 8s ago
  Process: 8550 ExecStartPre=/usr/sbin/hiawatha -k (code=exited, status=0/SUCCES
  Process: 8548 ExecStartPre=/usr/sbin/wigwam (code=exited, status=0/SUCCESS)
 Main PID: 8553 (hiawatha)
   CGroup: /system.slice/hiawatha.service
           └─8553 /usr/sbin/hiawatha -d

Pointed firefox at localhost and saw the welcome message:
Installation successful

Congratulations! The Hiawatha webserver has successfully been installed on this system. For more information about this webserver, visit the Hiawatha website.
[...]

Visited some familiar weblinks like exoplanet.eu and APOD.
Started a php server on port 8000 and successfully ran a sample php script at localhost:8000/

So far it looks fine.  Did not make  much headway with the tests referred to in comment 2 but shall have another look at them.

CC: (none) => tarazed25

Len Lawrence 2019-03-13 13:02:52 CET

Whiteboard: (none) => MGA6-64-OK

Dave Hodgins 2019-03-14 20:45:10 CET

Keywords: (none) => advisory, validated_update
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 4 Mageia Robot 2019-03-14 22:41:18 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0112.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED