Bug 30288

Summary:	netatalk new security issues CVE-2022-0194 and CVE-2022-2312[2-4]
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	David GEIGER <geiger.david68210>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal
Version:	8
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	netatalk-3.1.12-9.mga9.src.rpm	CVE:
Status comment:	Upstream fix in 3.1.13 caused regression, no good fix yet
Bug Depends on:	30287, 31255
Bug Blocks:

Description David Walser 2022-04-14 00:35:28 CEST

+++ This bug was initially created as a clone of Bug #30287 +++

SUSE has issued an advisory today (April 13):
https://lists.suse.com/pipermail/sle-security-updates/2022-April/010700.html

The issues are fixed upstream in 3.1.13.

3.1.13 also has fixes for CVE-2022-0194 and CVE-2022-2312[2-4], but the patch that fixed those issues caused a regression, so SUSE reverted it for their update.

Mageia 8 is also affected.

David Walser 2022-04-14 00:35:55 CEST

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Upstream fix in 3.1.13 caused regression, no good fix yet

Comment 1 Lewis Smith 2022-04-14 08:49:05 CEST

This package has no formal maintainer, but am assigning this (& its companion 30287) to DavidG who commited version: 3.1.12 - over 3y ago!

Assignee: bugsquad => geiger.david68210

David Walser 2022-12-09 17:43:59 CET

Depends on: (none) => 31255

Comment 2 David GEIGER 2023-01-31 06:33:26 CET

Fixed in Cauldron with latest 3.1.14 release!

David Walser 2023-01-31 15:40:08 CET

Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)

Comment 3 David GEIGER 2023-01-31 18:17:09 CET

Done also for mga8!

Comment 4 David Walser 2023-02-01 16:31:28 CET

(In reply to David GEIGER from comment #2)
> Fixed in Cauldron with latest 3.1.14 release!

Are you sure that 3.1.14 fixes these CVEs (do you have a link that confirms that)?  What about the CVE in Bug 31255?

Comment 5 David GEIGER 2023-02-01 17:00:59 CET

 from NEWS file:


Changes in 3.1.13
=================
* FIX: CVE-2021-31439
* FIX: CVE-2022-23121
* FIX: CVE-2022-23123
* FIX: CVE-2022-23122
* FIX: CVE-2022-23125
* FIX: CVE-2022-23124
* FIX: CVE-2022-0194
* FIX: afpd: make a variable declaration a definition
* UPD: Remove bundled libevent

Comment 6 David Walser 2023-02-01 23:53:00 CET

Ahh, so we already knew those fixes were in 3.1.13.  The question is does 3.1.14 fix the regression?

Comment 7 David GEIGER 2023-02-02 06:59:33 CET

Don't really know, it is not clearly mentioned in NEWS file:

https://github.com/Netatalk/Netatalk/commit/895cecbeeae655b2793df6fcbf9df1c1bfbe285d

Comment 8 David Walser 2023-02-07 05:39:03 CET

Fixed in:
https://advisories.mageia.org/MGASA-2023-0027.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED