Bug 25742

Summary:	signing-party new security issue CVE-2019-11627
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	andrewsfarm, brtians1, geiger.david68210, herman.viaene, sysadmin-bugs, tmb
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK
Source RPM:	signing-party-2.7-2.mga7.src.rpm	CVE:
Status comment:

Description David Walser 2019-11-25 17:45:38 CET

openSUSE has issued an advisory on May 13:
https://lists.opensuse.org/opensuse-security-announce/2019-05/msg00029.html

The issue is fixed upstream in 2.10.

Comment 1 David GEIGER 2019-11-25 17:57:10 CET

Done!

Comment 2 David Walser 2019-11-25 19:28:11 CET

Advisory:
========================

Updated signing-party package fixes security vulnerability:

The gpg-key2ps tool in signing-party contained an unsafe shell call enabling
shell injection via a User ID (CVE-2019-11627).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11627
https://lists.opensuse.org/opensuse-updates/2019-05/msg00085.html
========================

Updated packages in core/updates_testing:
========================
signing-party-2.10-1.mga7

from signing-party-2.10-1.mga7.src.rpm

Assignee: geiger.david68210 => qa-bugs
CC: (none) => geiger.david68210

Comment 3 Herman Viaene 2019-11-30 20:20:03 CET

MGA7-64 Plasma on Lenovo B50
No istallation issues
No idea what  to test here. Googled and found https://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html#overview which is hardly encouraging me that there is a simple wat to test this.
Apparently installing this does not blow up anything else.

CC: (none) => herman.viaene

Comment 4 Brian Rockwell 2019-12-13 00:55:28 CET

I generated a key using gpg, fingerprinted it, and signed it.

Then generated the following partial using the utility mentioned above:

$ gpg-key2ps 55CD3C892D36F8FD
%!PS-Adobe-3.0
%%BoundingBox: 0 0 612 792
%%Title: 
%%Creator: gpg-key2ps 
%%CreationDate: Thu Dec 12 17:53:13 2019
%%Pages: 1
%%EndComments


This is working as designed.

Herman - we should get together and have a key signing party - when should I arrive.  ;-)

Whiteboard: (none) => MGA7-64-OK
CC: (none) => brtians1

Comment 5 Thomas Andrews 2019-12-14 00:01:08 CET

Validating. Advisory in comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2019-12-14 00:45:58 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 6 Mageia Robot 2019-12-14 01:38:15 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0386.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED