| Summary: | crmsh possible new security issues (including CVE-2020-35459) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, geiger.david68210, mageia, ouaurelien, sysadmin-bugs |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | crmsh-3.0.3-2.mga7.src.rpm | CVE: | CVE-2020-35459 |
| Status comment: | |||
|
Description
David Walser
2020-10-18 00:48:41 CEST
Hi, thanks for reporting this bug. Assigned to the package maintainer, belong to ennael. All packagers cc'd. (Please set the status to 'assigned' if you are working on it) Keywords:
(none) =>
Triaged Anne hasn't been active in packaging for years. Assignee:
ennael1 =>
pkg-bugs
David Walser
2020-12-27 21:04:43 CET
CC:
pkg-bugs =>
geiger.david68210 new rpm in cauldron based on latest 4.2.0 git snapshot Version:
Cauldron =>
7 New rpm in mga7:
src:
crmsh-4.2.0-0.39d42c2.1.mga7Assignee:
pkg-bugs =>
qa-bugs Build failed, saving advisory for later. Advisory: ======================== Updated crmsh packages fix security vulnerabilities: The crm configure and hb_report commands failed to sanitize sensitive information by default (bsc#1163581). The crmsh package has been updated to the latest git snapshot, fixing these issues and several others. References: https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00032.html ======================== Updated packages in core/updates_testing: ======================== crmsh-scripts-4.2.0-0.39d42c2.1.mga7 crmsh-test-4.2.0-0.39d42c2.1.mga7 crmsh-4.2.0-0.39d42c2.1.mga7 from crmsh-4.2.0-0.39d42c2.1.mga7.src.rpm Assignee:
qa-bugs =>
mageia
Nicolas Lécureuil
2021-01-02 01:10:18 CET
Status comment:
Build failed in Mageia 7 =>
(none) An additional patch needs to be applied to crmsh, see this message: https://www.openwall.com/lists/oss-security/2021/01/12/3 Summary:
crmsh possible new security issues =>
crmsh possible new security issues (including CVE-2020-35459) fix pushed in cauldron. Version:
Cauldron =>
7 fix pushed in mageia 7:
src:
crmsh-4.2.0-0.39d42c2.1.1.mga7Assignee:
mageia =>
qa-bugs Advisory: ======================== Updated crmsh packages fix security vulnerabilities: The crm configure and hb_report commands failed to sanitize sensitive information by default (bsc#1163581). An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges (CVE-2020-25459). The crmsh package has been updated to the latest git snapshot, fixing these issues and several others. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35459 https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00032.html ======================== Updated packages in core/updates_testing: ======================== crmsh-scripts-4.2.0-0.39d42c2.1.1.mga7 crmsh-test-4.2.0-0.39d42c2.1.1.mga7 crmsh-4.2.0-0.39d42c2.1.1.mga7 from crmsh-4.2.0-0.39d42c2.1.1.mga7.src.rpm (In reply to David Walser from comment #7) > An additional patch needs to be applied to crmsh, see this message: > https://www.openwall.com/lists/oss-security/2021/01/12/3 SUSE has issued an advisory for this on January 12: https://lists.suse.com/pipermail/sle-security-updates/2021-January/008178.html openSUSE has issued an advisory for this on January 13: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RKSUG2OZN3Y2FQVQ55HP5MZIQZXZ5OD6/ Adding reference to the advisory. Advisory: ======================== Updated crmsh packages fix security vulnerabilities: The crm configure and hb_report commands failed to sanitize sensitive information by default (bsc#1163581). An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges (CVE-2020-25459). The crmsh package has been updated to the latest git snapshot and patched for CVE-2020-25459, fixing these issues and several others. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35459 https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00032.html https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RKSUG2OZN3Y2FQVQ55HP5MZIQZXZ5OD6/ No installation issues. The original crmsh installation brought in corosync and some other dependencies. Updating the packages brought in those listed above plus a couple of python3 packages. Crmsh is supposed to be a tool to help with configuration of Pacemaker, so... Pacemaker already installed for another bug. Attempted to use the procedure in Bug 24691 to configure and start the corosync service, but failed miserably. I'm assuming that's because I misinterpreted the instructions for editing the /etc/corosync/corosync.conf file. Undeterred, I tried to follow som commands from a link in bug 11724: http://clusterlabs.org/wiki/Example_configurations I didn't get very far here, either: root@localhost ~]# crm crm(live/localhost.localdomain)# cib new test-conf Signon to CIB failed: Transport endpoint is not connected crm(live/localhost.localdomain)# But then, as I look at Bug 11724, I see that Claire didn't get much farther with her test. At least the "crm" command seems to work OK. That's as far as I can go with this. I'm willing to OK it on a clean install, and the single command that did work. If it needs more, I'll need some help to get there. CC:
(none) =>
andrewsfarm I'm sending this on. Validating. Advisory in Comment 12. CC:
(none) =>
sysadmin-bugs Advisory pushed to SVN. CC:
(none) =>
ouaurelien An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0049.html Resolution:
(none) =>
FIXED |