Bug 29607

Summary:	opensc new security issues CVE-2021-42779 and CVE-2021-4278[0-2]
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	andrewsfarm, davidwhodgins, herman.viaene, mageia, sysadmin-bugs
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	opensc-0.21.0-1.mga8.src.rpm	CVE:
Status comment:

Description David Walser 2021-10-30 19:48:47 CEST

SUSE has issued an advisory on October 29:
https://lists.suse.com/pipermail/sle-security-updates/2021-October/009683.html

The issues are fixed upstream in 0.22.0:
https://github.com/OpenSC/OpenSC/releases/tag/0.22.0

David Walser 2021-10-30 19:50:11 CEST

Status comment: (none) => Fixed upstream in 0.22.0

Comment 1 Sander Lepik 2021-11-08 08:43:41 CET

FYI: I've submitted opensc 0.22.0 to core/updates_testing for mga8. Will update bug later with details, if no one doesn't beat me to it.

Comment 2 David Walser 2021-11-09 19:30:13 CET

Packages list:
opensc-0.22.0-1.mga8
libopensc8-0.22.0-1.mga8
libsmm-local8-0.22.0-1.mga8
libopensc-devel-0.22.0-1.mga8

from opensc-0.22.0-1.mga8.src.rpm

Status comment: Fixed upstream in 0.22.0 => (none)
Assignee: mageia => qa-bugs
CC: (none) => mageia

Comment 3 Herman Viaene 2021-11-10 16:08:01 CET

MGA8-64 Plasma on Lenovo B50
No installation issues.
Used my Belgian eid-c

CC: (none) => herman.viaene

Comment 4 Herman Viaene 2021-11-10 16:10:48 CET

Wrong key!!!!
Used my Belgian eid-card to test
$ eidenv 
Using reader with a card: VASCO DIGIPASS 870 [CCID] 00 00
BELPIC_CARDNUMBER: etc.......
To be sure, configured Firefox and was able to access Bgeov-sites and identify myself using my eic-card. Worked OK.

Whiteboard: (none) => MGA8-64-OK

Comment 5 Thomas Andrews 2021-11-11 21:31:00 CET

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2021-11-18 18:58:34 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 6 Mageia Robot 2021-11-18 22:52:26 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0512.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED