| Summary: | flatpak new security issues CVE-2023-28100 and CVE-2023-28101 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, fri, geiger.david68210, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | flatpak-1.14.0-1.mga9.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2023-03-16 17:21:40 CET
David Walser
2023-03-16 17:21:57 CET
Status comment:
(none) =>
Fixed upstream in 1.14.4 (Awaiting freeze move, to be clear) Whether DavidG or NicolasL does the M8 bit - up to you. Assigning this to neoclust for M8 anyway. He has done previous flatpak version updates, and is registered maintainer for flatpack (not the same thing!). Assignee:
bugsquad =>
mageia Done for mga8 updating to 1.12.8. Cauldron still pending freeze move. Mageia 8 update: flatpak-1.12.8-1.mga8 flatpak-tests-1.12.8-1.mga8 libflatpak0-1.12.8-1.mga8 libflatpak-gir1.0-1.12.8-1.mga8 libflatpak-devel-1.12.8-1.mga8 from flatpak-1.12.8-1.mga8.src.rpm References: https://github.com/flatpak/flatpak/releases/tag/1.12.8 mga8-64 OK, on Plasma, nvidia-currrent, Intel i7, kernel 5.15.88-desktop-1.mga8 Updated installed packages to - flatpak-1.12.8-1.mga8.x86_64 - lib64flatpak-gir1.0-1.12.8-1.mga8.x86_64 - lib64flatpak0-1.12.8-1.mga8.x86_64 Tests ok: before and after system reboot o $ flatpak update (updates flatpak apps) o Firefox with internet video o Signal (phone-desktop integration) o Spotify o Simple launching of: Blender, KiCAD, Fritzing (an old flatpak) CC:
(none) =>
fri More info on the CVEs: https://www.openwall.com/lists/oss-security/2023/03/17/1 https://www.openwall.com/lists/oss-security/2023/03/17/2
Morgan Leijström
2023-03-21 17:40:35 CET
Assignee:
mageia =>
qa-bugs Cauldron freeze move is performed Mga8-64 is working for me, validating Advisory needed Version:
Cauldron =>
8
David Walser
2023-03-21 19:30:43 CET
Status comment:
Fixed upstream in 1.14.4 =>
(none)
Dave Hodgins
2023-03-24 00:41:05 CET
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0115.html Resolution:
(none) =>
FIXED |