Bug 31139

Summary: 389-ds-base possible new security issue CVE-2021-45710
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: Mageia Bug Squad <bugsquad>
Status: RESOLVED INVALID QA Contact: Sec team <security>
Severity: normal    
Priority: Normal CC: lewyssmith, nicolas.salguero, rverschelde
Version: Cauldron   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Source RPM: 389-ds-base-1.4.0.26-16.mga9.src.rpm CVE:
Status comment:

Description David Walser 2022-11-16 17:57:54 CET 
SUSE has issued an advisory on November 15:
https://lists.suse.com/pipermail/sle-security-updates/2022-November/012931.html

The CVE is actually in rust, so I'm guessing it needs to be fixed there and then 389-ds-base needs to be recompiled with that update.  If this CVE has already been fixed in our rust, then the last 389-ds-base update we did should be good.
David Walser 2022-11-16 17:58:11 CET

CC: (none) => nicolas.salguero, rverschelde

Comment 2 Nicolas Salguero 2022-11-17 10:29:32 CET 
Hi,

That CVE affects tokio but 389-ds-base-1.4.0.26 does not seem to use that crate but another one: rsds.

Best regards,

Nico.
Comment 3 Lewis Smith 2022-11-17 12:10:21 CET 
Does this mean that this is not relevant to Mageia?
If so, can it be closed 'invalid'?

Await luigi's response.

CC: (none) => lewyssmith

Comment 4 David Walser 2022-11-17 13:35:18 CET 
Has our rust package fixed this issue?
Comment 5 Nicolas Salguero 2022-11-17 14:17:23 CET 
I cannot find any package named tokio or rust-tokio.
Comment 6 Rémi Verschelde 2022-11-17 14:36:39 CET 
Duplicate of bug 30001?

(In reply to David Walser from comment #4)
> Has our rust package fixed this issue?

According to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45710:

> An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.

Both rust-1.60.0-1.mga8 and rust-1.65.0-1.mga9 use tokio 1.8.4 as a vendored crate, so it should be fine.
Comment 7 David Walser 2022-11-17 15:03:11 CET 
Thanks.

Resolution: (none) => INVALID
Status: NEW => RESOLVED