Bug 29020

Summary:	slic3r new security issue CVE-2020-28591
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, fri, geiger.david68210, herman.viaene, nicolas.salguero, ouaurelien, sysadmin-bugs
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7TOO MGA7-64-OK MGA8-64-OK
Source RPM:	slic3r-1.3.0-6.mga8.src.rpm	CVE:	CVE-2020-28591
Status comment:

Description David Walser 2021-05-29 19:52:33 CEST

Fedora has issued an advisory on March 23:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TCSYYURJTUKJSEZIPDAXK4NHRXZMHIVA/

Mageia 7 and Mageia 8 are also affected.

David Walser 2021-05-29 19:52:47 CEST

CC: (none) => geiger.david68210
Status comment: (none) => Patch available from Fedora
Whiteboard: (none) => MGA8TOO, MGA7TOO

Comment 1 Lewis Smith 2021-05-29 22:00:47 CEST

No fixed maintainer; safest to assign this bug globally.

Assignee: bugsquad => pkg-bugs

Morgan Leijström 2021-05-30 01:35:29 CEST

CC: (none) => fri

Comment 2 Nicolas Salguero 2021-06-02 13:56:25 CEST

Suggested advisory:
========================

The updated package fixes a security vulnerability:

An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted AMF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2020-28591)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28591
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TCSYYURJTUKJSEZIPDAXK4NHRXZMHIVA/
========================

Updated package in 7/core/updates_testing:
========================
slic3r-1.3.0-1.1.mga7

from SRPM:
slic3r-1.3.0-1.1.mga7.src.rpm

Updated package in 8/core/updates_testing:
========================
slic3r-1.3.0-6.1.mga8

from SRPM:
slic3r-1.3.0-6.1.mga8.src.rpm

CVE: (none) => CVE-2020-28591
CC: (none) => nicolas.salguero
Status comment: Patch available from Fedora => (none)
Status: NEW => ASSIGNED
Version: Cauldron => 8
Whiteboard: MGA8TOO, MGA7TOO => MGA7TOO
Assignee: pkg-bugs => qa-bugs

Comment 3 Herman Viaene 2021-06-16 15:31:53 CEST

MGA7-64 Plasma on Lenovo B50
No installation issues.
As in bug 25473 Comment 6 I cannot really test this, because of lack of a 3D printer and knowlege on the subject.
But the command opens a proper GUI and goes thru a proper settings wizard, so OK for me.

Whiteboard: MGA7TOO => MGA7TOO MGA7-64-OK
CC: (none) => herman.viaene

Comment 4 Herman Viaene 2021-06-19 14:51:04 CEST

MGA8-64 Plasma on Lenovo B50
No installation issues.
Same test and result as Comment 3, OK for me.

Whiteboard: MGA7TOO MGA7-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK

Comment 5 Thomas Andrews 2021-06-20 15:19:29 CEST

I'm unaware of anyone in QA with a 3D printer, So it looks as if you've done as well with tis one as any of us, Herman. Validating. Advisory in Comment 2.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Aurelien Oudelet 2021-06-22 21:36:57 CEST

Keywords: (none) => advisory
Source RPM: slic3r-1.3.0-7.mga9.src.rpm => slic3r-1.3.0-6.mga8.src.rpm
CC: (none) => ouaurelien

Comment 6 Mageia Robot 2021-06-23 19:14:45 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0276.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED