Bug 25638

Summary:	libapreq2 new security issue CVE-2019-12412
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, geiger.david68210, herman.viaene, sysadmin-bugs, tarazed25, tmb
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK
Source RPM:	libapreq2-2.130.0-28.mga8.src.rpm	CVE:
Status comment:

Description David Walser 2019-10-31 04:34:43 CET

Debian has issued an advisory on October 4:
https://www.debian.org/security/2019/dsa-4541

Mageia 7 is also affected.

David Walser 2019-10-31 04:35:05 CET

Whiteboard: (none) => MGA7TOO
Summary: libapreq2 new security issue => libapreq2 new security issue CVE-2019-12412

Comment 1 David GEIGER 2019-10-31 06:53:37 CET

Done!

CC: (none) => geiger.david68210

Comment 2 Lewis Smith 2019-10-31 09:37:27 CET

This package has no maintainer, so assigning this globally.

Assignee: bugsquad => pkg-bugs

Comment 3 David Walser 2019-10-31 13:04:36 CET

Advisory:
========================

Updated libapreq2 packages fix security vulnerability:

Max Kellermann reported a NULL pointer dereference flaw in libapreq2, allowing
a remote attacker to cause a denial of service against an application using the
library (application crash) if an invalid nested "multipart" body is processed
(CVE-2019-12412).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12412
https://www.debian.org/security/2019/dsa-4541
========================

Updated packages in core/updates_testing:
========================
libapreq2_3-2.130.0-28.1.mga7
libapreq-devel-2.130.0-28.1.mga7
perl-libapreq2-2.130.0-28.1.mga7
apache-mod_apreq-2.130.0-28.1.mga7

from libapreq-2.130.0-28.1.mga7.src.rpm

Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA7TOO => (none)
Version: Cauldron => 7

Comment 4 Herman Viaene 2019-11-02 14:03:49 CET

MGA7-64 Plasma on Lenovo B50
No installation issues.
Tried to find anything that uses these packages, the only thing I found was mason. Found a  tutorial for that, but this seems real developer stuff. Not in my league.
I will agree on OK'ing on a clean install.

CC: (none) => herman.viaene

Comment 5 Len Lawrence 2019-11-09 07:49:37 CET

@Hermam, comment 4
Had a look at this and have to agree, it would take a month of Sundays to get to grips with mason or autodia.  A clean install was all that could be achieved here.  Adding the OK for you.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => tarazed25

Comment 6 Thomas Andrews 2019-11-14 01:43:59 CET

Going with that, then. Validating. Advisory in Comment 3.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2019-11-14 16:41:18 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 7 Mageia Robot 2019-11-14 18:34:29 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0327.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 8 Nicolas Salguero 2020-11-19 09:37:46 CET

*** Bug 27624 has been marked as a duplicate of this bug. ***