Bug 31123

Summary:	xmlrpc-c new security issues CVE-2022-25236 CVE-2022-2531[345] CVE-2022-40674 CVE-2022-43680
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	All Packagers <pkg-bugs>
Status:	NEW ---	QA Contact:	Sec team <security>
Severity:	critical
Priority:	Normal	CC:	geiger.david68210, mageia, nicolas.salguero
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA9TOO
Source RPM:	xmlrpc-c-1.51.07-4.mga9.src.rpm	CVE:
Status comment:

Description David Walser 2022-11-14 19:00:36 CET

xmlrpc-c bundles expat code, which is vulnerable to security issues:
https://bugzilla.redhat.com/show_bug.cgi?id=2056370
https://bugzilla.redhat.com/show_bug.cgi?id=2056350
https://bugzilla.redhat.com/show_bug.cgi?id=2056354
https://bugzilla.redhat.com/show_bug.cgi?id=2056363
https://bugzilla.redhat.com/show_bug.cgi?id=2130769
https://bugzilla.redhat.com/show_bug.cgi?id=2140059

and possibly others.

David Walser 2022-11-14 19:00:59 CET

Whiteboard: (none) => MGA8TOO

Comment 1 Lewis Smith 2022-11-14 20:30:43 CET

Unsure who might be responsible for this, so assigning it globally; but CC'ing both NicolasS who has touched it recently, and neoclust who is the registered maintainer. If either of you take this up, please re-assign to yourself.

Assignee: bugsquad => pkg-bugs
CC: (none) => mageia, nicolas.salguero

Comment 2 David GEIGER 2024-06-15 09:32:29 CEST

Removing Mageia 8 from whiteboard due to EOL!

Whiteboard: MGA8TOO => MGA9TOO
CC: (none) => geiger.david68210