Bug 30664

(In reply to David Walser from comment #0)
> Fedora has issued an advisory today (July 23):
> https://lists.fedoraproject.org/archives/list/package-announce@lists.
> fedoraproject.org/thread/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/
> 
> Mageia 8 is also affected.
> 
> The following other packages may also be affected:
> ceph
> cockpit
> couchdb
> ipyparallel
> workrave
> cldr-emoji-annotation
> pgadmin4

Assigning to the registered maintainer of jupyter-notebook, who also maintains ipyparallel

CC'ing:
eatdirt for ceph,
colin for cockpit, in case his loved ones want him to spend some time on Mageia :-)
yochenhsieh (haven't seen you for a long time, either, hope you and Colin are fine!) for cldr-emoji-annotation
joequant for pgadmin4
and all packagers collectively for the rest.

Please clone this report for each package (apart from jupyter-notebook) that is affected and assign it to yourself.

Assignee: bugsquad => makowski.mageia
CC: (none) => eatdirt, joequant, mageia, marja11, pkg-bugs, yochenhsieh

Sorry, could you help explain why cldr-emoji-annotation is affected. Fedora didn't rebuild or patch it after python-notebook is fixed.

Fedora patched python-notebook because it included moment, but cldr-emoji-annotation does not use moment.

(In reply to You-Cheng Hsieh from comment #2)
> Sorry, could you help explain why cldr-emoji-annotation is affected. Fedora
> didn't rebuild or patch it after python-notebook is fixed.
> 
> Fedora patched python-notebook because it included moment, but
> cldr-emoji-annotation does not use moment.

Only python-notebook has been addressed, they haven't gotten to the other ones yet.  Apparently they ran some sort of scanner and found moment bundled in other packages:
https://bugzilla.redhat.com/show_bug.cgi?id=2105075#c17

Thanks David!
This comment confirmed it's a false positive:
https://bugzilla.redhat.com/show_bug.cgi?id=2105075#c8
"The package is considered to include moment because of moment being listed in tools/cldr-apps/js/package-lock.json (in sources).  However, moment does not seem to be included in the srpm and also in any binary rpm, hence this looks like false positive."

And I checked cldr-emoji-annotation of MGA8 does have that json.

Sorry for correction:
cldr-emoji-annotation of MGA8 does not have that json. This package is not affected.

Ubuntu has issued an advisory for moment on August 10:
https://ubuntu.com/security/notices/USN-5559-1

Nevermind. Read the above more carefully.

Patches related to bugs:
CVE-2022-24785: https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5
CVE-2022-31129: https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3

CC: (none) => bruno
Status: NEW => ASSIGNED

Papoteur made an update since tht BR in august to 6.4.12. I'm not finding any reference to the code impatce in these patches into the code, so I assume it has been fixed.

Could someone else confirm ?

CC: (none) => yves.brungard_mageia

Debian-LTS has issued an advisory for nodejs-moment on January 31:
https://www.debian.org/lts/security/2023/dla-3295

Jupyter-notebook is already updated. See https://bugs.mageia.org/show_bug.cgi?id=30789

Source RPM: jupyter-notebook-6.3.0-3.mga9.src.rpm => (none)

Hi, I don't think ceph is affected, we don't build high level tools, java is explicitly disabled and I don't find any reference, or bundle moment.js, file in our package.
The only occurrence could be in the mgr dashboard python module, that we also explicitly disabled, on purpose.


Cheers,
Chris.

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Path traversal in moment.locale. (CVE-2022-24785)

Inefficient parsing algorithim resulting in DoS. (CVE-2022-31129)

References:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/
https://ubuntu.com/security/notices/USN-5559-1
https://www.debian.org/lts/security/2023/dla-3295
========================

Updated packages in core/updates_testing:
========================
jupyter-notebook-6.4.12-1.1.mga9
python3-jupyter-notebook-6.4.12-1.1.mga9

from SRPM:
jupyter-notebook-6.4.12-1.1.mga9.src.rpm

Assignee: makowski.mageia => qa-bugs
Status comment: Patches available from Fedora => (none)
CVE: (none) => CVE-2022-24785, CVE-2022-31129
Whiteboard: MGA8TOO => (none)
Version: Cauldron => 9
CC: (none) => nicolas.salguero

mga9, x64

The PoC trail led nowhere.

Reference bug 22780.
$ jupyter-notebook --generate-config
Writing default config to: /home/lcl/.jupyter/jupyter_notebook_config.py

$ jupyter-notebook
[I 16:35:00.817 NotebookApp] Writing notebook server cookie secret to /home/lcl/
.local/share/jupyter/runtime/notebook_cookie_secret
[I 16:35:01.616 NotebookApp] Serving notebooks from local directory: /run/media/lcl/Toshiba/qa/jupyter-notebook
[I 16:35:01.616 NotebookApp] Jupyter Notebook 6.4.12 is running at:
[I 16:35:01.616 NotebookApp] http://localhost:8888/?token=1dc484af9c62f68a11e77d2252509af9e93126dca69d2d65

The application opened in a browser at localhost:8088/
Cut and pasted a ruby script into the page - used the menu to rename it and select ruby as the language and it applied the usual colour coding to the text.
Downloaded the script using the menu again.

Having to wait just now for the mirror to sync.

CC: (none) => tarazed25

Updated the two packages and removed the jupyter branch from ~/.local/share/.
$ jupyter-notebook --generate-config
Overwrite /home/lcl/.jupyter/jupyter_notebook_config.py with default config? [y/N]y
Writing default config to: /home/lcl/.jupyter/jupyter_notebook_config.py
$ jupyter-notebook[I 18:09:36.662 NotebookApp] Writing notebook server cookie secret to /home/lcl/.local/share/jupyter/runtime/notebook_cookie_secret
[I 18:09:36.771 NotebookApp] Serving notebooks from local directory: /run/media/lcl/Toshiba/qa/jupyter-notebook
[...]
   To access the notebook, open this file in a browser:
        file:///home/lcl/.local/share/jupyter/runtime/nbserver-2421968-open.html
    Or copy and paste one of these URLs:
        http://localhost:8888/?token=c79f51f4e12bff77825f773d68d2314ef7083d6cb66221b3
     or http://127.0.0.1:8888/?token=c79f51f4e12bff77825f773d68d2314ef7083d6cb66221b3

That opened the notebook in the browser.
Quit from the browser:
[I 18:11:58.238 NotebookApp] Shutting down on /api/shutdown request.
[I 18:11:58.239 NotebookApp] Shutting down 0 kernels
[I 18:11:58.239 NotebookApp] Shutting down 0 terminals

The file method did not reopen the notebook nor did the URL.
$ jupyter-notebook
[I 18:17:03.269 NotebookApp] Serving notebooks from local directory: /run/media/lcl/Toshiba/qa/jupyter-notebook
[I 18:17:03.269 NotebookApp] Jupyter Notebook 6.4.12 is running at:
[I 18:17:03.269 NotebookApp] http://localhost:8888/?token=b1c68ba7e30a4f30147da86531aa628d387d8c1589a21b04
[I 18:17:03.269 NotebookApp]  or http://127.0.0.1:8888/?token=b1c68ba7e30a4f30147da86531aa628d387d8c1589a21b04
[I 18:17:03.269 NotebookApp] Use Control-C to stop this server and shut down all kernels (twice to skip confirmation).
[C 18:17:03.301 NotebookApp] 
...

Home page displayed in browser.
Created a new page with some code on it then another.  All three pages available via tabs.  Downloaded one of them and checked that it did arrive.  Colour coding working correctly.
Back to the home page where all the pages were indexed and accessible through the index.
So, at the simple level the notebook works fine.
Shut down the server.  

$ curl -O https://raw.githubusercontent.com/jupyter/notebook/master/docs/source/examples/Notebook/Running%20Code.ipynb
$ jupyter-notebook Running%20Code.ipynb
This showed a page with snippets of python code and an additional Run button.  Highlighted code snippets and pressed run.  Seemed to work.
Collapsed long lists with a click of the mouse.

Giving this the go-ahead for 644-bits.

Whiteboard: (none) => MGA9-64-OK

s/644/64.  !!

644-bits, eh? Wow. I'll have to look for one of those on eBay...

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Or maybe in AI labs?

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0067.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED