Bug 28687

Summary:	wireshark new release 3.4.4 fixes security issue
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, brtians1, mageia, ouaurelien, sysadmin-bugs
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	wireshark-3.4.3-1.mga8.src.rpm	CVE:	CVE-2021-22191
Status comment:

Description David Walser 2021-03-31 02:52:51 CEST

Upstream has released new versions on March 10:
https://www.wireshark.org/news/20210310.html

Mageia 8 needs to be upgraded to 3.4.4, which fixes a security issue:
https://www.wireshark.org/docs/relnotes/wireshark-3.4.4.html
https://www.wireshark.org/security/wnpa-sec-2021-03
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22191

Jani has updated it in Cauldron and hopefully won't mind packaging this update.

David Walser 2021-03-31 02:53:20 CEST

Assignee: bugsquad => jani.valimaa

Comment 1 Nicolas Lécureuil 2021-04-02 21:35:09 CEST

updated in mga8:

src:
    - wireshark-3.4.4-1.mga8

Assignee: jani.valimaa => qa-bugs
CC: (none) => mageia

Comment 2 David Walser 2021-04-04 17:40:53 CEST

Advisory:
========================

Updated wireshark packages fix security vulnerability:

Wireshark could open unsafe URLs (CVE-2021-22191).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22191
https://www.wireshark.org/security/wnpa-sec-2021-03
https://www.wireshark.org/docs/relnotes/wireshark-3.4.4.html
https://www.wireshark.org/news/20210310.html
========================

Updated packages in core/updates_testing:
========================
wireshark-3.4.4-1.mga8
libwireshark-devel-3.4.4-1.mga8
wireshark-tools-3.4.4-1.mga8
libwiretap11-3.4.4-1.mga8
tshark-3.4.4-1.mga8
dumpcap-3.4.4-1.mga8
rawshark-3.4.4-1.mga8
libwsutil12-3.4.4-1.mga8
libwireshark14-3.4.4-1.mga8

from wireshark-3.4.4-1.mga8.src.rpm

Comment 3 Brian Rockwell 2021-04-12 04:17:01 CEST

# uname -a
Linux localhost 5.10.27-desktop-1.mga8 #1 SMP Tue Mar 30 23:14:59 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux



The following 13 packages are going to be installed:

- dumpcap-3.4.4-1.mga8.x86_64
- lib64bcg729_0-1.1.1-1.mga8.x86_64
- lib64nl-route3_200-3.5.0-2.mga8.x86_64
- lib64qt5multimedia5-5.15.2-1.mga8.x86_64
- lib64smi2-0.5.0-4.mga8.x86_64
- lib64wireshark14-3.4.4-1.mga8.x86_64
- lib64wiretap11-3.4.4-1.mga8.x86_64
- lib64wsutil12-3.4.4-1.mga8.x86_64
- libsmi-mibs-std-0.5.0-4.mga8.x86_64
- rawshark-3.4.4-1.mga8.x86_64
- smi-tools-0.5.0-4.mga8.x86_64
- wireshark-3.4.4-1.mga8.x86_64
- wireshark-tools-3.4.4-1.mga8.x86_64

----

I ran some captures - working as designed.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => brtians1

Comment 4 Thomas Andrews 2021-04-12 15:27:19 CEST

Thank you, Brian. Validating. Advisory in Comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Aurelien Oudelet 2021-04-12 15:30:11 CEST

Keywords: (none) => advisory
CC: (none) => ouaurelien
CVE: (none) => CVE-2021-22191

Comment 5 Mageia Robot 2021-04-12 22:02:37 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0185.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED