Bug 25864

Summary:	shadowsocks-libev new security issues CVE-2019-5163 and CVE-2019-5164
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, eatdirt, geiger.david68210, herman.viaene, olav, sysadmin-bugs, tmb
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK
Source RPM:	shadowsocks-libev-3.2.3-2.mga7.src.rpm	CVE:
Status comment:

Description David Walser 2019-12-12 23:42:24 CET

openSUSE has issued an advisory on December 11:
https://lists.opensuse.org/opensuse-updates/2019-12/msg00070.html

Mageia 7 is also affected.

Comment 1 David Walser 2019-12-12 23:42:50 CET

The issues are fixed upstream in 3.3.3.

CC: (none) => eatdirt
Whiteboard: (none) => MGA7TOO

Comment 2 David GEIGER 2019-12-13 03:55:24 CET

Already done for Cauldron!

CC: (none) => geiger.david68210

Comment 3 David GEIGER 2019-12-13 03:58:16 CET

And now done for mga7!

Comment 4 David Walser 2019-12-13 04:25:00 CET

Advisory:
========================

Updated shadowsocks-libev packages fix security vulnerabilities:

Exploitable denial-of-service vulnerability exists in the UDPRelay
functionality (CVE-2019-5163).

Code execution vulnerability in the ss-manager binary (CVE-2019-5164).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5163
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5164
https://lists.opensuse.org/opensuse-updates/2019-12/msg00070.html
========================

Updated packages in core/updates_testing:
========================
shadowsocks-libev-3.3.3-1.mga7
libshadowsocks2-3.3.3-1.mga7
libshadowsocks-devel-3.3.3-1.mga7

from shadowsocks-libev-3.3.3-1.mga7.src.rpm

CC: (none) => olav
Source RPM: shadowsocks-libev-3.3.0-1.mga8.src.rpm => shadowsocks-libev-3.2.3-2.mga7.src.rpm
Version: Cauldron => 7
Assignee: olav => qa-bugs
Whiteboard: MGA7TOO => (none)

Comment 5 Herman Viaene 2020-01-04 14:14:24 CET

MGA7-64 Plasma on Lenovo B50
No installation issues.
Bug 22037 decided OK on clean install.Did a little research and found: https://www.tipsforchina.com/how-to-setup-a-fast-shadowsocks-server-on-vultr-vps-the-easy-way.html
Does look like something I want to venture into.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => herman.viaene

Comment 6 Thomas Andrews 2020-01-04 23:20:47 CET

Validating. Advisory in Comment 4.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2020-01-05 13:55:58 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 7 Mageia Robot 2020-01-05 16:39:46 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0006.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED