Bug 30806

Summary:	sofia-sip new security issues CVE-2022-3100[1-3]
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	critical
Priority:	Normal	CC:	andrewsfarm, davidwhodgins, mageia, mageia, marja11, sysadmin-bugs
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	sofia-sip-1.12.11-13.mga9.src.rpm	CVE:
Status comment:

Description David Walser 2022-09-02 18:31:23 CEST

Debian-LTS has issued an advisory today (September 2):
https://www.debian.org/lts/security/2022/dla-3091

The issues are fixed upstream in 1.13.8:
https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-79jq-hh82-cv9g
https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-g3x6-p824-x6hm
https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8w5j-6g2j-pxcp

Mageia 8 is also affected.

David Walser 2022-09-02 18:31:34 CEST

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 1.13.8

Comment 1 Marja Van Waes 2022-09-02 20:48:00 CEST

Assigning to all packagers collectively, because the registered maintainer is most likely still unavailable. CC'ing him, though

CC: (none) => mageia, marja11
Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Lécureuil 2022-09-05 22:08:34 CEST

Patches added in mga8. New version pushed in mga9

src:
    - sofia-sip-1.12.11-10.1.mga8

Version: Cauldron => 8
Status comment: Fixed upstream in 1.13.8 => (none)
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA8TOO => (none)
CC: (none) => mageia

Comment 3 David Walser 2022-09-05 22:37:18 CEST

Note that this is not yet fixed in Cauldron because of a build error.

libsofia-sip-devel-1.12.11-10.1.mga8
libsofia-sip0-1.12.11-10.1.mga8
sofia-sip-1.12.11-10.1.mga8
libsofia-sip-static-devel-1.12.11-10.1.mga8

from sofia-sip-1.12.11-10.1.mga8.src.rpm

Comment 4 David Walser 2022-09-06 14:27:50 CEST

Cauldron has been fixed by Jani.

Comment 5 Thomas Andrews 2022-09-19 03:02:27 CEST

Tested in VirtualBox. No installation issues.

"Sofia-SIP is an open-source SIP  User-Agent library, compliant with the IETF RFC3261 specification (see the feature table). It can be used as a building block for SIP client software for uses such as VoIP, IM, and many other real-time and person-to-person communication services."

Sounds like developer territory to me. No previous updates, and urpmq --whatrequires wasn't much help. Looked at the file list for sifia-sip, and found some man files for some utilities. Tried a few simple ones, and they seemed to work.

Anything more is beyond me. I'm giving it an OK, mostly based on the clean install. Validating.

Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2022-09-20 22:23:37 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 6 Mageia Robot 2022-09-21 20:17:01 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0343.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED