Bug 26963

Summary:	libslirp new security issue CVE-2020-10756
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Mageia Bug Squad <bugsquad>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	geiger.david68210
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	libslirp-4.2.0-2.mga8.src.rpm	CVE:
Status comment:

Description David Walser 2020-07-16 23:56:09 CEST

Upstream has issued an advisory on July 8:
https://github.com/rootless-containers/slirp4netns/security/advisories/GHSA-96c5-v27g-58vf

The issue is fixed upstream in 4.3.1.

More info on SUSE and RedHat bugs:
https://bugzilla.suse.com/show_bug.cgi?id=1172380
https://bugzilla.redhat.com/show_bug.cgi?id=1835986

Comment 1 David Walser 2020-07-17 00:25:16 CEST

Fedora has issued an advisory for this on July 15:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JYTZ32P67PZER6P7TW6FQK3SZRKQLVEI/

BTW, slirp4netns has a broken version in Cauldron (IPv6 specifically) so it should be updated to the latest.

Comment 2 David GEIGER 2020-07-17 10:52:09 CEST

Done! closed this bug.

Status: NEW => RESOLVED
Resolution: (none) => FIXED
CC: (none) => geiger.david68210

Comment 3 David Walser 2020-07-17 12:31:25 CEST

libslirp-4.3.1-1.mga8
slirp4netns-1.1.4-1.mga8