Bug 28708

Summary:	pdfbox new security issues CVE-2021-27807 and CVE-2021-27906
Product:	Mageia	Reporter:	Nicolas Lécureuil <mageia>
Component:	Security	Assignee:	Nicolas Lécureuil <mageia>
Status:	RESOLVED OLD	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	java, luigiwalser, ouaurelien, security
Version:	7
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	pdfbox-2.0.21-2.mga8.src.rpm	CVE:
Status comment:	Fixed upstream in 2.0.23
Bug Depends on:	28682, 29125
Bug Blocks:	23251

Description Nicolas Lécureuil 2021-04-03 00:26:21 CEST

+++ This bug was initially created as a clone of Bug #28682 +++

Apache has issued advisories on March 19:
https://www.openwall.com/lists/oss-security/2021/03/19/9
https://www.openwall.com/lists/oss-security/2021/03/19/10

The issues are fixed upstream in 2.0.23.

Mageia 7 is also affected (see also Bug 23251).

Nicolas Lécureuil 2021-04-03 00:27:57 CEST

Depends on: 28682 => (none)

David Walser 2021-04-03 00:30:52 CEST

Depends on: (none) => 28682

David Walser 2021-04-03 00:31:41 CEST

Status comment: (none) => Fixed upstream in 2.0.23

Aurelien Oudelet 2021-04-03 20:41:34 CEST

CC: (none) => ouaurelien
Assignee: bugsquad => mageia

Comment 1 David Walser 2021-05-29 20:17:08 CEST

Fedora has issued an advisory for this on March 26:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ/

David Walser 2021-06-13 23:44:13 CEST

Depends on: (none) => 29125

Comment 2 David Walser 2021-07-01 18:30:55 CEST

https://blog.mageia.org/en/2021/06/08/mageia-7-will-reach-end-of-support-on-30th-of-june-the-king-is-dead-long-live-the-king/

Resolution: (none) => OLD
Status: NEW => RESOLVED