Bug 25729

Summary:	python-ecdsa new security issues CVE-2019-1485[39]
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	andrewsfarm, geiger.david68210, herman.viaene, sysadmin-bugs, tmb
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK
Source RPM:	python-ecdsa-0.13.2-1.mga7.src.rpm	CVE:
Status comment:

Description David Walser 2019-11-23 17:23:36 CET

Ubuntu has issued an advisory on November 18:
https://usn.ubuntu.com/4196-1/

The issues are fixed upstream in 0.13.3.

Comment 1 David GEIGER 2019-11-23 17:32:36 CET

Done!

CC: (none) => geiger.david68210

Comment 2 David Walser 2019-11-23 17:47:31 CET

Advisory:
========================

Updated python-ecdsa packages fix security vulnerability:

It was discovered that python-ecdsa incorrectly handled certain signatures. A
remote attacker could possibly use this issue to cause python-ecdsa to generate
unexpected exceptions, resulting in a denial of service (CVE-2019-14853).

It was discovered that python-ecdsa incorrectly verified DER encoding in
signatures. A remote attacker could use this issue to perform certain
malleability attacks (CVE-2019-14859).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14853
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14859
https://usn.ubuntu.com/4196-1/
========================

Updated packages in core/updates_testing:
========================
python-ecdsa-0.13.3-1.mga7
python3-ecdsa-0.13.3-1.mga7

from python-ecdsa-0.13.3-1.mga7.src.rpm

Assignee: bugsquad => qa-bugs

Comment 3 Herman Viaene 2019-11-28 14:57:35 CET

MGA7-64 Plasma on Lenovo B50
No installation issues.
No previous updates on these packages.
I have been googling a bit for a simple example for this, but the ones I found involved the installation and usage of other developers stuff for python, so I gave up on those.
If others agree, I will not oppose an OK on clean install.

CC: (none) => herman.viaene

Comment 4 Thomas Andrews 2020-01-03 21:29:42 CET

OKing on a clean install. Validating. Advisory in Comment 2.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2020-01-05 12:28:10 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 5 Mageia Robot 2020-01-05 16:39:36 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0002.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED