| Summary: | packagekit new security issue CVE-2020-16121 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | mhrambo3501, ouaurelien, sysadmin-bugs |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | packagekit-1.1.12-3.mga7.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2020-09-25 01:02:29 CEST
David Walser
2020-09-25 01:02:36 CEST
Whiteboard:
(none) =>
MGA7TOO Can we assign this to you, Neal, as having done the main recent commits on this? (Re-assign it to pkg-bugs if this does not suit you). Assignee:
bugsquad =>
ngompa13 Patched package uploaded for cauldron and Mageia 7. Advisory: ======================== Updated packagekit package fixes security vulnerability: It was discovered that packagekit was subject to a vulnerability where the InstallFiles, GetFilesLocal and GetDetailsLocal methods of the DBus interface to PackageKit accesses given files before checking for authorization. This allows non-privileged users to learn the MIME type of any file on the system (CVE-2020-16121). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16121 https://ubuntu.com/security/notices/USN-4538-1 ======================== Updated packages in core/updates_testing: ======================== lib64packagekit-devel-1.1.12-3.1.mga7.x86_64.rpm lib64packagekit-glib18-1.1.12-3.1.mga7.x86_64.rpm lib64packagekitglib-gir1.0-1.1.12-3.1.mga7.x86_64.rpm packagekit-1.1.12-3.1.mga7.x86_64.rpm packagekit-command-not-found-1.1.12-3.1.mga7.x86_64.rpm packagekit-cron-1.1.12-3.1.mga7.x86_64.rpm packagekit-gstreamer-plugin-1.1.12-3.1.mga7.x86_64.rpm packagekit-gtk3-module-1.1.12-3.1.mga7.x86_64.rpm packagekit-gtk-module-1.1.12-3.1.mga7.x86_64.rpm from packagekit-1.1.12-3.1.mga7.src.rpm Assignee:
ngompa13 =>
qa-bugs M7 x86_64 Plasma PackageKit update installs: lib64packagekit-glib18 1.1.12 3.1.mga7 x86_64 lib64packagekitglib-gir1.0 1.1.12 3.1.mga7 x86_64 packagekit 1.1.12 3.1.mga7 x86_64 packagekit-gtk-module 1.1.12 3.1.mga7 x86_64 This is OK. PackageKit is a package manager available through pkcon command. $ pkcon backend-details Nom: dnf Description: Dnf Auteur: Richard Hughes <richard@hughsie.com> $ pkcon get-updates Obtention des mises à jour [=========================] Chargement du cache [=========================] Terminé [=========================] Il n'y a pas de mise à jour disponible pour le moment. $ pkcon repo-list Obtention des dépôts [=========================] Terminé [=========================] Activé mageia-x86_64-nonfree Mageia 7 - x86_64 - Nonfree Activé updates-x86_64-nonfree Mageia 7 - x86_64 - Nonfree - Updates Désactivé updates_testing-x86_64-nonfree Mageia 7 - x86_64 - Nonfree - Test Updates Désactivé backports-x86_64-nonfree Mageia 7 - x86_64 - Nonfree - Backports Désactivé backports_testing-x86_64-nonfree Mageia 7 - x86_64 - Nonfree - Test Backports Désactivé mageia-x86_64-nonfree-debuginfo Mageia 7 - x86_64 - Nonfree - Debug Désactivé updates-x86_64-nonfree-debuginfo Mageia 7 - x86_64 - Nonfree - Updates - Debug Désactivé updates_testing-x86_64-nonfree-debuginfo Mageia 7 - x86_64 - Nonfree - Test Updates - Debug Désactivé backports-x86_64-nonfree-debuginfo Mageia 7 - x86_64 - Nonfree - Backports - Debug Désactivé backports_testing-x86_64-nonfree-debuginfo Mageia 7 - x86_64 - Nonfree - Test Backports - Debug Désactivé mageia-i586 Mageia 7 - i586 Désactivé updates-i586 Mageia 7 - i586 - Updates Désactivé updates_testing-i586 Mageia 7 - i586 - Test Updates Désactivé backports-i586 Mageia 7 - i586 - Backports Désactivé backports_testing-i586 Mageia 7 - i586 - Test Backports Désactivé mageia-i586-debuginfo Mageia 7 - i586 - Debug Désactivé updates-i586-debuginfo Mageia 7 - i586 - Updates - Debug Désactivé updates_testing-i586-debuginfo Mageia 7 - i586 - Test Updates - Debug Désactivé backports-i586-debuginfo Mageia 7 - i586 - Backports - Debug Désactivé backports_testing-i586-debuginfo Mageia 7 - i586 - Test Backports - Debug Désactivé mageia-x86_64-nonfree-source Mageia 7 - x86_64 - Nonfree - Source Désactivé updates-x86_64-nonfree-source Mageia 7 - x86_64 - Nonfree - Updates - Source Désactivé updates_testing-x86_64-nonfree-source Mageia 7 - x86_64 - Nonfree - Test Updates - Source Désactivé backports-x86_64-nonfree-source Mageia 7 - x86_64 - Nonfree - Backports - Source Désactivé backports_testing-x86_64-nonfree-source Mageia 7 - x86_64 - Nonfree - Test Backports - Source Désactivé mageia-x86_64-source Mageia 7 - x86_64 - Source Désactivé updates-x86_64-source Mageia 7 - x86_64 - Updates - Source Désactivé updates_testing-x86_64-source Mageia 7 - x86_64 - Test Updates - Source Désactivé backports-x86_64-source Mageia 7 - x86_64 - Backports - Source Désactivé backports_testing-x86_64-source Mageia 7 - x86_64 - Test Backports - Source Désactivé mageia-x86_64-tainted-source Mageia 7 - x86_64 - Tainted - Source Désactivé updates-x86_64-tainted-source Mageia 7 - x86_64 - Tainted - Updates - Source Désactivé updates_testing-x86_64-tainted-source Mageia 7 - x86_64 - Tainted - Test Updates - Source Désactivé backports-x86_64-tainted-source Mageia 7 - x86_64 - Tainted - Backports - Source Désactivé backports_testing-x86_64-tainted-source Mageia 7 - x86_64 - Tainted - Test Backports - Source Désactivé mageia-x86_64-tainted Mageia 7 - x86_64 - Tainted Désactivé updates-x86_64-tainted Mageia 7 - x86_64 - Tainted - Updates Désactivé updates_testing-x86_64-tainted Mageia 7 - x86_64 - Tainted - Test Updates Désactivé backports-x86_64-tainted Mageia 7 - x86_64 - Tainted - Backports Désactivé backports_testing-x86_64-tainted Mageia 7 - x86_64 - Tainted - Test Backports Désactivé mageia-x86_64-tainted-debuginfo Mageia 7 - x86_64 - Tainted - Debug Désactivé updates-x86_64-tainted-debuginfo Mageia 7 - x86_64 - Tainted - Updates - Debug Désactivé updates_testing-x86_64-tainted-debuginfo Mageia 7 - x86_64 - Tainted - Test Updates - Debug Désactivé backports-x86_64-tainted-debuginfo Mageia 7 - x86_64 - Tainted - Backports - Debug Désactivé backports_testing-x86_64-tainted-debuginfo Mageia 7 - x86_64 - Tainted - Test Backports - Debug Désactivé mageia-i586-tainted Mageia 7 - i586 - Tainted Désactivé updates-i586-tainted Mageia 7 - i586 - Tainted - Updates Désactivé updates_testing-i586-tainted Mageia 7 - i586 - Tainted - Test Updates Désactivé backports-i586-tainted Mageia 7 - i586 - Tainted - Backports Désactivé backports_testing-i586-tainted Mageia 7 - i586 - Tainted - Test Backports Désactivé mageia-i586-tainted-debuginfo Mageia 7 - i586 - Tainted - Debug Désactivé updates-i586-tainted-debuginfo Mageia 7 - i586 - Tainted - Updates - Debug Désactivé updates_testing-i586-tainted-debuginfo Mageia 7 - i586 - Tainted - Test Updates - Debug Désactivé backports-i586-tainted-debuginfo Mageia 7 - i586 - Tainted - Backports - Debug Désactivé backports_testing-i586-tainted-debuginfo Mageia 7 - i586 - Tainted - Test Backports - Debug Activé mageia-x86_64 Mageia 7 - x86_64 Activé updates-x86_64 Mageia 7 - x86_64 - Updates Désactivé updates_testing-x86_64 Mageia 7 - x86_64 - Test Updates Désactivé backports-x86_64 Mageia 7 - x86_64 - Backports Désactivé backports_testing-x86_64 Mageia 7 - x86_64 - Test Backports Désactivé mageia-x86_64-debuginfo Mageia 7 - x86_64 - Debug Désactivé updates-x86_64-debuginfo Mageia 7 - x86_64 - Updates - Debug Désactivé updates_testing-x86_64-debuginfo Mageia 7 - x86_64 - Test Updates - Debug Désactivé backports-x86_64-debuginfo Mageia 7 - x86_64 - Backports - Debug Désactivé backports_testing-x86_64-debuginfo Mageia 7 - x86_64 - Test Backports - Debug Désactivé mageia-i586-nonfree Mageia 7 - i586 - Nonfree Désactivé updates-i586-nonfree Mageia 7 - i586 - Nonfree - Updates Désactivé updates_testing-i586-nonfree Mageia 7 - i586 - Nonfree - Test Updates Désactivé backports-i586-nonfree Mageia 7 - i586 - Nonfree - Backports Désactivé backports_testing-i586-nonfree Mageia 7 - i586 - Nonfree - Test Backports Désactivé mageia-i586-nonfree-debuginfo Mageia 7 - i586 - Nonfree - Debug Désactivé updates-i586-nonfree-debuginfo Mageia 7 - i586 - Nonfree - Updates - Debug Désactivé updates_testing-i586-nonfree-debuginfo Mageia 7 - i586 - Nonfree - Test Updates - Debug Désactivé backports-i586-nonfree-debuginfo Mageia 7 - i586 - Nonfree - Backports - Debug Désactivé backports_testing-i586-nonfree-debuginfo Mageia 7 - i586 - Nonfree - Test Backports - Debug This is OK for now. MGA7-64-OK CC:
(none) =>
ouaurelien Validating update Packages and Advisory in Comment 2. Advisory pushed to SVN. Keywords:
(none) =>
advisory, validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0415.html Status:
NEW =>
RESOLVED |