Bug 31743

Summary:	rizin new security issues CVE-2022-34612, CVE-2022-36039, CVE-2022-3604[0-4], CVE-2023-27590
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Nicolas Lécureuil <mageia>
Status:	RESOLVED OLD	QA Contact:	Sec team <security>
Severity:	critical
Priority:	Normal	CC:	geiger.david68210, marja11, nicolas.salguero, yvesbrungard
Version:	8
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	rizin-0.4.1-1.mga9.src.rpm	CVE:
Status comment:	Fixed upstream in 0.5.2

Description David Walser 2023-03-30 23:31:12 CEST

Fedora has issued an advisory today (March 30):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CKIMUQATTY7VMFMU2DEKO4TBILZ5Q4CT/

The issues in the Fedora advisory (plus CVE-2022-36039) are fixed upstream in 0.4.1:
https://github.com/rizinorg/rizin/releases/tag/v0.4.1
https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pg
https://github.com/rizinorg/rizin/security/advisories/GHSA-h897-rhm9-rpmw
https://github.com/rizinorg/rizin/security/advisories/GHSA-2c7m-2f37-mr5m
https://github.com/rizinorg/rizin/security/advisories/GHSA-pf72-jg54-8gvp
https://github.com/rizinorg/rizin/security/advisories/GHSA-rjhv-mj4g-j4p5
https://github.com/rizinorg/rizin/security/advisories/GHSA-mqcj-82c6-gh5q

Upstream has also released 0.5.2, fixing CVE-2023-27590:
https://github.com/rizinorg/rizin/releases/tag/v0.5.2
https://github.com/rizinorg/rizin/security/advisories/GHSA-rqcp-m8m2-jcqf

Mageia 8 is also affected.

David Walser 2023-03-30 23:31:32 CEST

Status comment: (none) => Fixed upstream in 0.5.2
Whiteboard: (none) => MGA8TOO

Comment 1 Marja Van Waes 2023-04-02 10:55:26 CEST

Assigning to the registered rizin maintainer

Assignee: bugsquad => mageia
CC: (none) => marja11

Comment 2 papoteur 2023-06-28 09:08:53 CEST

Release 0.5.2 is in cauldron/testing

CC: (none) => yves.brungard_mageia

Comment 3 papoteur 2023-06-28 20:57:47 CEST

I presume that radare2-cutter has to be rebuilt for lib64rizin0.

Comment 4 David GEIGER 2023-07-03 06:54:16 CEST

Fixed for cauldron now!

CC: (none) => geiger.david68210
Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8

Comment 5 Nicolas Salguero 2024-01-12 10:43:38 CET

Mageia 8 EOL

CC: (none) => nicolas.salguero
Resolution: (none) => OLD
Status: NEW => RESOLVED