Bug 28927

Summary:	perl-Image-ExifTool new security issue CVE-2021-22204
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, mageia, nicolas.salguero, ouaurelien, sysadmin-bugs
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7TOO MGA7-64-OK MGA8-64-OK
Source RPM:	perl-Image-ExifTool-12.160.0-1.mga9.src.rpm	CVE:	CVE-2021-22204
Status comment:

Description David Walser 2021-05-15 00:29:55 CEST

A security issue fixed upstream in ExifTool has been announced on May 9:
https://www.openwall.com/lists/oss-security/2021/05/09/1

The issue is fixed upstream in 12.24.

A PoC is given in the reply to the message above.

Mageia 7 and Mageia 8 are also affected.

David Walser 2021-05-15 00:30:08 CEST

Whiteboard: (none) => MGA8TOO, MGA7TOO
Status comment: (none) => Fixed upstream in 12.24

Comment 1 Nicolas Salguero 2021-05-18 09:10:10 CEST

*** Bug 28880 has been marked as a duplicate of this bug. ***

CC: (none) => nicolas.salguero

Comment 2 David Walser 2021-05-18 14:09:07 CEST

Fedora has issued an advisory for this on May 5:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/

Comment 3 David Walser 2021-05-28 00:19:25 CEST

Debian has issued an advisory for this on May 2:
https://www.debian.org/security/2021/dsa-4910

Comment 4 David Walser 2021-05-30 22:56:12 CEST

openSUSE has issued an advisory for this on May 10:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/

Comment 5 Nicolas Lécureuil 2021-06-12 23:50:49 CEST

Fixed in mga 7/8

src:
     - perl-Image-ExifTool-11.300.0-1.1.mga7
     - perl-Image-ExifTool-12.0.0-1.1.mga8

CC: (none) => mageia
Status comment: Fixed upstream in 12.24 => (none)
Version: Cauldron => 8
Whiteboard: MGA8TOO, MGA7TOO => MGA7TOO

Nicolas Lécureuil 2021-06-12 23:51:03 CEST

Assignee: thierry.vignaud => qa-bugs

Comment 6 Thomas Andrews 2021-06-15 22:48:59 CEST

MGA7-64-Plasma in VirtualBox. Before the update, the POC shows this:


   $ printf 'P1 1 1 0' > moo.pbm
   $ cjb2 moo.pbm moo.djvu
   $ printf 'ANTa\0\0\0\40"(xmp(\\\n".qx(cowsay pwned>&2);#"' >> moo.djvu
   $ exiftool moo.djvu > /dev/null
    _______
   < pwned >
    -------
           \   ^__^
            \  (oo)\_______
               (__)\       )\/\
                   ||----w |
                   ||     ||

No installation issues with the update. After the update, the POC commands result in no output. 

It looks like that is what is expected, so giving this an OK for MGA7.

Whiteboard: MGA7TOO => MGA7TOO MGA7-64-OK
CC: (none) => andrewsfarm

Comment 7 Thomas Andrews 2021-06-15 23:05:51 CEST

Same test as before, only with MGA8, same results. OK for MGA8. Validating. 

I gotta say, I've milked more than a few cows in my time, and some were prettier than others, but those have to be the ugliest cows I have ever dealt with. Terrible conformation, and they look underfed...

Whiteboard: MGA7TOO MGA7-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Aurelien Oudelet 2021-06-16 09:10:16 CEST

Advisory:
========================

Updates perl-Image-ExifTool package fixes a security vulnerability:

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image (CVE-2021-22204).

References:
 - https://bugs.mageia.org/show_bug.cgi?id=28927
 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22204
 - https://www.openwall.com/lists/oss-security/2021/05/09/1
 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/
 - https://www.debian.org/security/2021/dsa-4910
 - https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/
========================

Updated packages in 7/core/updates_testing:
========================
perl-Image-ExifTool-11.300.0-1.1.mga7

from SRPM:
perl-Image-ExifTool-11.300.0-1.1.mga7.src.rpm
========================

Updated packages in 8/core/updates_testing:
========================
perl-Image-ExifTool-12.0.0-1.1.mga8

from SRPM:
perl-Image-ExifTool-12.0.0-1.1.mga8.src.rpm
========================

CVE: (none) => CVE-2021-22204
Keywords: (none) => advisory
CC: (none) => ouaurelien

Comment 9 Mageia Robot 2021-06-16 22:24:02 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0259.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED