| Summary: | golang new security issues CVE-2021-27918, CVE-2021-31525, CVE-2021-3319[5-8], CVE-2021-34558 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, bruno, herman.viaene, joequant, mageia, nicolas.salguero, ouaurelien, pterjan, sysadmin-bugs, tarazed25 |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | golang-1.15.6-2.mga8.src.rpm | CVE: | CVE-2021-27918, CVE-2021-31525, CVE-2021-3319[5-8], CVE-2021-34558 |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 28228 | ||
|
Description
David Walser
2021-05-30 03:46:41 CEST
David Walser
2021-05-30 03:47:03 CEST
Whiteboard:
(none) =>
MGA8TOO, MGA7TOO
David Walser
2021-05-30 03:47:20 CEST
CC:
(none) =>
mageia Unsure where to asign this. Joseph is official maintainer, & did 1.15.5 & 6; so CC'ing him. NicolasL did some CVEs since; then Pascal most recently, so adding him too. With all these possibles, assigning globally; the CCs will see it. CC:
(none) =>
joequant, pterjan openSUSE has issued an advisory on March 27: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4PG5AXR4LXEWYU5DHYEVESCXWKO3HFHO/ The issue is fixed upstream in 1.15.9. Summary:
golang new security issue CVE-2021-31525 =>
golang new security issues CVE-2021-27918 and CVE-2021-31525 openSUSE has issued an advisory for the original CVE today (June 23): https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FEBF3TK6RJGTIEOIZ3AQJ3GEDOBRMLER/ openSUSE has issued an advisory on June 28: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EXHOWUQKHNS4LEJ2GTYWY2EEAYVCKECW/ CVE-2021-33196 is fixed upstream in 1.15.13, so I assume the others are as well. Mageia 8 is also affected, and Mageia 7 may also be. Summary:
golang new security issues CVE-2021-27918 and CVE-2021-31525 =>
golang new security issues CVE-2021-27918, CVE-2021-31525, CVE-2021-3319[5-8] Removing Mageia 7 from whiteboard due to EOL: https://blog.mageia.org/en/2021/06/08/mageia-7-will-reach-end-of-support-on-30th-of-june-the-king-is-dead-long-live-the-king/ Whiteboard:
MGA8TOO, MGA7TOO =>
MGA8TOO RPMs list: golang-docs-1.15.13-1.mga8 golang-misc-1.15.13-1.mga8 golang-tests-1.15.13-1.mga8 golang-1.15.13-1.mga8 golang-src-1.15.13-1.mga8 golang-shared-1.15.13-1.mga8 golang-bin-1.15.13-1.mga8 from golang-1.15.13-1.mga8.src.rpm CC:
(none) =>
nicolas.salguero Build fails for Cauldron. openSUSE has issued an advisory today (July 19): https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AKQH4LHYIFOWBEGMGHD7S7TTV7JL4U7W/ The issue is fixed upstream in 1.15.14 and 1.16.6: https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ Status comment:
Fixed upstream in 1.15.13 =>
Fixed upstream in 1.15.14 For Cauldron, some tests fail because the BS has no access to the network so I changed the SPEC file so that the build does not fail if the tests fail. RPMs list: golang-docs-1.15.14-1.mga8 golang-misc-1.15.14-1.mga8 golang-tests-1.15.14-1.mga8 golang-1.15.14-1.mga8 golang-src-1.15.14-1.mga8 golang-shared-1.15.14-1.mga8 golang-bin-1.15.14-1.mga8 from golang-1.15.14-1.mga8.src.rpm
David Walser
2021-07-20 13:53:13 CEST
Status comment:
Fixed upstream in 1.15.14 =>
(none) Equivalent openSUSE advisory for golang 1.15.x: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OZJXXUXBI66VV2PXRNAWN4MCE3AOHNBA/ MGA8-64 Plasma on Lenovo B50 Mo installation issues. Tried to follow procedure from bug26465, but immediately run into problem, because of my lack of knowledge $ mgarepo co -d 7 docker Host key verification failed. svn: E170013: Unable to connect to a repository at URL 'svn+ssh://svn.mageia.org/svn/packages/updates/7/docker/current' svn: E210002: To better debug SSH connection problems, remove the -q option from 'ssh' in the [tunnels] section of your Subversion configuration file. svn: E210002: Network connection closed unexpectedly CC:
(none) =>
herman.viaene You need to uncomment the line in /etc/mgarepo.conf to change it to anonymous. ## uncomment it in case you don't have a account in the Mageia build system: #mirror = svn://svn.mageia.org/svn/packages/ Advisory: ======================== Updated golang packages fix security vulnerabilities: encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method (CVE-2021-27918). net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations (CVE-2021-31525). A security issue has been found in Go before version 1.16.5. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use. (CVE-2021-33195). A security issue has been found in Go. Due to a pre-allocation optimization in zip.NewReader, a malformed archive which indicates it has a significant number of files can cause either a panic or memory exhaustion (CVE-2021-33196). ReverseProxy fails to delete the Connection headers (as well as other legacy hop-by-hop headers, which however per RFC 7230 need to also be specified in Connection) if there are multiple ones and the first is empty, due to an incorrect Get(h) == "" check. This can lead to a security issue if the proxy is adding an important header, like X-Forwarded-For, and is sitting in front of another proxy which can be instructed by an attacker to drop that header as a hop-by-hop header (CVE-2021-33197). A security issue has been found in Go before version 1.16.5. The SetString and UnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198). The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic (CVE-2021-34558). References: - https://bugs.mageia.org/show_bug.cgi?id=29037 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27918 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31525 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33195 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33196 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33197 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33198 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34558 - https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EXHOWUQKHNS4LEJ2GTYWY2EEAYVCKECW/ - https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4PG5AXR4LXEWYU5DHYEVESCXWKO3HFHO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QLUQXBCOPWP72ZSS3SM3CTURM7XOYALQ/ - https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AKQH4LHYIFOWBEGMGHD7S7TTV7JL4U7W/ -https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OZJXXUXBI66VV2PXRNAWN4MCE3AOHNBA/ ======================== Updated packages in core/updates_testing: ======================== golang-docs-1.15.14-1.mga8 golang-misc-1.15.14-1.mga8 golang-tests-1.15.14-1.mga8 golang-1.15.14-1.mga8 golang-src-1.15.14-1.mga8 golang-shared-1.15.14-1.mga8 golang-bin-1.15.14-1.mga8 from golang-1.15.14-1.mga8.src.rpm CC:
(none) =>
ouaurelien @Herman with respect to comment 12. You have specified the mga7 repository. mga8 is the default now so $ mgarepo co docker works. co stands for "checkout". The command will create the directory docker. $ ls docker SOURCES/ SPECS/ CC:
(none) =>
tarazed25 @Herman
Don't know about you but I am having problems:
$ bm -ls
creating package list
processing package %{origname}-%{moby_version}-%mkrel 1
building source package
warning: Macro expanded in comment on line 40: %{shortcommit_moby}
warning: line 115: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-swarm
warning: line 117: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-vim
Wrote: /home/lcl/docker/SRPMS/docker-20.10.5-1.mga8.src.rpm
succeeded!
$ sudo urpmi --buildrequires SPECS/docker.spec
warning: Macro expanded in comment on line 40: %{shortcommit_moby}
warning: line 115: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-swarm
warning: line 117: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-vim
The following packages can't be installed because they depend on packages
that are older than the installed ones:
glibc-static-devel-2.32-14.mga8
lib64xcrypt-static-devel-4.4.17-1.mga8
docker-20.10.5-1.mga8
Continue installation anyway? (Y/n) n
@ Len I even don't get that far, because $ bm -ls bash: bm: command not found and urpmf bm returns hunderds of lines Calling urpmf with two letters is rarely going to be fruitful because it will match too many things. Just urpmi bm. As for Len, because you installed packages from updates_testing, you'll need to install the matching devel packages from there or downgrade what you updated (or enable updates_testing). I'm not sure why it's trying to install docker though, that seems wrong. $ cd docker/
$ bm -ls
creating package list
processing package %{origname}-%{moby_version}-%mkrel 1
building source package
waarschuwing: Macro expanded in comment on line 40: %{shortcommit_moby}
waarschuwing: line 115: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-swarm
waarschuwing: line 117: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-vim
Wrote: /home/tester8/docker/SRPMS/docker-20.10.5-1.mga8.src.rpm
succeeded!
$ ls
BUILD/ BUILDROOT/ RPMS/ SOURCES/ SPECS/ SRPMS/
then switch to root
# ls
BUILD/ BUILDROOT/ RPMS/ SOURCES/ SPECS/ SRPMS/
[root@mach5 docker]# urpmi --buildrequires SPECS/docker.spec
waarschuwing: Macro expanded in comment on line 40: %{shortcommit_moby}
waarschuwing: line 115: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-swarm
waarschuwing: line 117: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-vim
Om aan de afhankelijkheden te voldoen worden de volgende pakketten geïnstalleerd:
Pakket Versie Uitgave Arch
(medium "Core Release (distrib1)")
cmake 3.19.2 2.mga8 x86_64
compat-golang-github-cpuguy83> 2.0.0 1.mga8 noarch
compat-golang-github-russross> 2.1.0 2.mga8 noarch
go-filesystem 3.0.9 1.mga8 x86_64
etc ..... till at the end
$MIRRORLIST: media/core/release/golang-github-hashicorp-lru-devel-0.5.4-1.mga8.noarch.rpm
installeren van cmake-3.19.2-2.mga8.x86_64.rpm golang-github-spf13-cobra-devel-1.0.0-3.mga8.noarch.rpm lib64btrfs-devel-5.10-1.mga8.x86_64.rpm lib64sqlite3-devel-3.34.1-1.mga8.x86_64.rpm golang-github-hashicorp-lru-devel-0.5.4-1.mga8.noarch.rpm vanaf /var/cache/urpmi/rpms
Voorbereiden... ###########################################################################################################################################################
51/55: golang-github-hashicorp-lru-devel
###########################################################################################################################################################
52/55: lib64sqlite3-devel ###########################################################################################################################################################
53/55: lib64btrfs-devel ###########################################################################################################################################################
54/55: golang-github-spf13-cobra-devel
###########################################################################################################################################################
55/55: cmake ###########################################################################################################################################################
and then
$ du -hs docker
60M docker
$ cd docker/
$ du -hs *
4,0K BUILD
4,0K BUILDROOT
4,0K RPMS
39M SOURCES
32K SPECS
21M SRPMS
I compared as far as I uderstand with thee results in bug 26465 and to me it looks OK, but I am quite unsure about this whole thing.
As long as the build succeeded and produced the rpms (in RPMS), you're good. @David re comment 18. I suspect that this has something to do with my using qarepo for the golang installation. In all previous cases I had used Updates Testing and probably built docker while Updates Testing was still enabled. @Herman with respect to comment 19. You should be able to complete the build now that you have the missing dependencies installed. You need to run the build machine again as the user. $ bm -l or just $ bm if you want to avoid the hundreds of lines of compiler messages. It takes a while. Tried the installation from Updates Testing direct.
Installed the dependencies without a problem:
1/10: lib64xcrypt-static-devel
#############################################
2/10: glibc-static-devel #############################################
3/10: golist #############################################
4/10: go-rpm-macros #############################################
5/10: lib64devmapper-devel #############################################
6/10: lib64ltdl-devel #############################################
7/10: lib64btrfs-devel #############################################
8/10: golang-net-devel #############################################
9/10: golang-github-cpuguy83-md2man
#############################################
10/10: golang-github-hashicorp-lru-devel
$ bm
creating package list
processing package %{origname}-%{moby_version}-%mkrel 1
building source and binary packages
succeeded!
So the problem must have been finger trouble while using qarepo.
Went on as Len suggested $ bm -l loads of feedback.... at the end: Wrote: /home/tester8/docker/SRPMS/docker-20.10.5-1.mga8.src.rpm Wrote: /home/tester8/docker/RPMS/x86_64/docker-fish-completion-20.10.5-1.mga8.x86_64.rpm Wrote: /home/tester8/docker/RPMS/x86_64/docker-nano-20.10.5-1.mga8.x86_64.rpm Wrote: /home/tester8/docker/RPMS/x86_64/docker-zsh-completion-20.10.5-1.mga8.x86_64.rpm Wrote: /home/tester8/docker/RPMS/x86_64/docker-logrotate-20.10.5-1.mga8.x86_64.rpm Wrote: /home/tester8/docker/RPMS/x86_64/docker-20.10.5-1.mga8.x86_64.rpm Wrote: /home/tester8/docker/RPMS/x86_64/docker-devel-20.10.5-1.mga8.x86_64.rpm Executing(%clean): /bin/sh -e /home/tester8/docker/BUILDROOT/rpm-tmp.XzFXeE + umask 022 + cd /home/tester8/docker/BUILD + cd moby-20.10.5 + /usr/bin/rm -rf /home/tester8/docker/BUILDROOT/docker-20.10.5-1.mga8.x86_64 + RPM_EC=0 ++ jobs -p + exit 0 succeeded! and $ ls RPMS/x86_64/ docker-20.10.5-1.mga8.x86_64.rpm docker-fish-completion-20.10.5-1.mga8.x86_64.rpm docker-nano-20.10.5-1.mga8.x86_64.rpm docker-devel-20.10.5-1.mga8.x86_64.rpm docker-logrotate-20.10.5-1.mga8.x86_64.rpm docker-zsh-completion-20.10.5-1.mga8.x86_64.rpm looks good. Whiteboard:
(none) =>
MGA8-64-OK Validating. Advisory in Comment 14. Keywords:
(none) =>
validated_update
Aurelien Oudelet
2021-07-23 22:57:41 CEST
CVE:
(none) =>
CVE-2021-27918, CVE-2021-31525, CVE-2021-3319[5-8], CVE-2021-34558 An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0369.html Resolution:
(none) =>
FIXED |