Bug 32071

Several packagers have dealt with the SRPMs in question, so assigning this globally; but CC'ing those packagers.

Assignee: bugsquad => pkg-bugs
CC: (none) => geiger.david68210, ghibomgx, jani.valimaa

gstreamer was updated in late may to 1.22.3.

There is a newer 1.22.4 nowadays, see changelog

https://gstreamer.freedesktop.org/releases/1.22/#1.22.4
https://gstreamer.freedesktop.org/security/

which address also several security bugs. IMHO we can prepare the gstreamer 1.22.4 triplets (good,bad,ugly) and then submit after the final mga9 release as update.

Ok, I've gstreamer 1.22.4 ready (tested in COPR). I'll submit to {core,tainted}/updates_testing, so it's ready for post-release.

The gstreamer suite and their deps aligned to 1.22.4 fixing this is in {core,tainted}/updates_testing since a month. Using locally I've not had any problems since then. If I understand correctly we'll decided delay to delay this submit post final-release. Maybe this should be reconsidered and release before? However in the meanwhile there were two new other advisor:

https://gstreamer.freedesktop.org/security/sa-2023-0005.html
https://gstreamer.freedesktop.org/security/sa-2023-0005.html

which however requires 1.22.5 which we don't have anyway in updates_testing.

It's quite a bit more than that.  We have all of these to deal with:
https://gstreamer.freedesktop.org/security/sa-2022-0002.html
https://gstreamer.freedesktop.org/security/sa-2022-0003.html
https://gstreamer.freedesktop.org/security/sa-2022-0004.html
https://gstreamer.freedesktop.org/security/sa-2023-0001.html
https://gstreamer.freedesktop.org/security/sa-2023-0002.html
https://gstreamer.freedesktop.org/security/sa-2023-0003.html
https://gstreamer.freedesktop.org/security/sa-2023-0004.html
https://gstreamer.freedesktop.org/security/sa-2023-0005.html

The 2022 just for Mageia 8 and the 2023 ones for both.

I'm not sure what Debian fixed in plugins-bad, but the above advisories cover base, good, and ugly.
CVE-2022-192[0,2-5], CVE-2022-2122 good
CVE-2023-3732[79] good
CVE-2023-37328 base
ZDI-CAN-2144[34] ugly

Summary: gstreamer1.0-plugins-{base,good,bad} possible new security issues => gstreamer1.0-plugins-{base,good,bad,ugly} new security issues CVE-2022-192[0,2-5], CVE-2022-2122, CVE-2023-3732[7-9], ZDI-CAN-2144[34]
Source RPM: gstreamer1.0-plugins-base-1.22.3-1.mga9.src.rpm, gstreamer1.0-plugins-bad-1.22.3-2.mga9.src.rpm, gstreamer1.0-plugins-good-1.22.3-1.mga9.src.rpm => gstreamer1.0-plugins-base-1.22.3-1.mga9.src.rpm, gstreamer1.0-plugins-bad-1.22.3-2.mga9.src.rpm, gstreamer1.0-plugins-good-1.22.3-1.mga9.src.rpm, gstreamer1.0-plugins-ugly-1.22.3-1.mga9.src.rpm
Status comment: (none) => Fixed upstream in 1.22.5

According to that list, up to https://gstreamer.freedesktop.org/security/sa-2023-0003.html, the fixes are covered in gstreamer 1.22.4 (which we have in updates_testing). The remaining sa-2023-0004.html and sa-2023-0005.html (I pasted twice the sa-2023-0005.html in my previous comment), which should refer to ZDI-CAN-2144[34], should be covered in gstreamer-1.22.5 (which we don't have [yet] in any repo).

All the gstreamer 1.22.5 packages fixing the known advisors are uploaded in mga9:core/updates_testing and mga9:tainted/updates_testing

Here is the list of packages for core/updates_testing:

gstreamer1.0-1.22.5-1.mga9.src.rpm
gstreamer1.0-devtools-1.22.5-1.mga9.src.rpm
gstreamer1.0-editing-services-1.22.5-1.mga9.src.rpm
gstreamer1.0-libav-1.22.5-1.mga9.src.rpm
gstreamer1.0-moodbar-1.2.1-4.mga9.src.rpm
gstreamer1.0-omx-1.22.5-1.mga9.src.rpm
gstreamer1.0-plugins-bad-1.22.5-1.mga9.src.rpm
gstreamer1.0-plugins-base-1.22.5-1.mga9.src.rpm
gstreamer1.0-plugins-good-1.22.5-1.mga9.src.rpm
gstreamer1.0-plugins-ugly-1.22.5-1.mga9.src.rpm
gstreamer1.0-python-1.22.5-1.mga9.src.rpm
gstreamer1.0-rtsp-server-1.22.5-1.mga9.src.rpm
gstreamer1.0-vaapi-1.22.5-1.mga9.src.rpm

and for tainted/updates_testing:

gstreamer1.0-plugins-bad-1.22.5-1.mga9.tainted.src.rpm
gstreamer1.0-plugins-ugly-1.22.5-1.mga9.tainted.src.rpm

The packages are waiting in queue, is there still missed something to push in updates?

BTW, in the meanwhile there is out 1.22.6.

Can we validate this bug and push gstreamer*1.22.5*? So that we can go to the next 1.22.6 that fixes further security bugs.

This was never assigned to QA, so it hasn't been tested and we can't validate yet. 

It's filed against Cauldron, should that be changed to Mageia 9?

CC: (none) => andrewsfarm

tYep, it was build when cauldron was still mga9, and the fixes postponed after final release, so to avoid further re-testing/slowdowns.

OK then, changing to 9. But, since MGA9 has been released, all updates must now go through QA. 

It says MGA8 is also affected, so we will need packages for that release, too. Once it's ready, assign it to QA and we'll get on it.

Version: Cauldron => 9

I don't know about mga8, probably too complex to backport every single patch to 1.18.5 which is the gstreamer release of mga8.

For mga9, alternatively we can ignore the package group of release 1.22.5 already made for mga9 that are in updates_testing, open a new specific bug for mga9, and go straight to release 1.22.6, which is the current one (that add a few security fixes not included in 1.22.5). But it will take some time.

Created attachment 14129 [details]
List of packages to test

The list is a few long testing put the list in attachment, I use the brain instead brute force to get the list but maybe miss something

(In reply to Giuseppe Ghibò from comment #13)
> I don't know about mga8, probably too complex to backport every single patch
> to 1.18.5 which is the gstreamer release of mga8.
> 
> For mga9, alternatively we can ignore the package group of release 1.22.5
> already made for mga9 that are in updates_testing, open a new specific bug
> for mga9, and go straight to release 1.22.6, which is the current one (that
> add a few security fixes not included in 1.22.5). But it will take some time.

Then we need to remove MGA8TOO and wait to new set of packages, I'll update the list when the packages are ready

CC: (none) => j.alberto.vc
Whiteboard: MGA8TOO => (none)

Created attachment 14228 [details]
List of gstreamer-1.22.8 packages

Here is an updated list of files for gstreamer-1.22.8 that supersedes for 1.22.5.

Attachment 14129 is obsolete: 0 => 1

Tested in Real Hardware Mageia 9 x86_64 Lxqt

Download all the rpms with qarepo
run in console as root urpmi --auto --auto-update

urpmi update the gstreamer packages I have in my system along other updates

 1/46: gstreamer1.0-tools    ###################################################################################
     2/46: lib64gstreamer1.0_0   ###################################################################################
     3/46: lib64gstreamer-plugins-base1.0_0
                                 ###################################################################################
     4/46: lib64gstgl1.0_0       ###################################################################################
     5/46: gstreamer1.0-plugins-base
                                 ###################################################################################
     6/46: lib64gstcodecparsers1.0_0
                                 ###################################################################################
     7/46: lib64gstwebrtc1.0_0   ###################################################################################
     8/46: lib64gstwebrtcnice1.0_0
                                 ###################################################################################
     9/46: lib64gstcodecs1.0_0   ###################################################################################
    10/46: gstreamer1.0-soup     ###################################################################################
    11/46: lib64gstcuda1.0_0     ###################################################################################
    12/46: lib64gstwayland1.0_0  ###################################################################################
    13/46: lib64gstplay1.0_0     ###################################################################################
    14/46: lib64gstbadaudio1.0_0 ###################################################################################
    15/46: lib64gstva1.0_0       ###################################################################################
    16/46: lib64gstbasecamerabinsrc1.0_0                              ###################################################################################
    17/46: lib64gstsctp1.0_0     ###################################################################################
    18/46: lib64gstmpegts1.0_0   ###################################################################################
    19/46: lib64gstphotography1.0_0
                                 ###################################################################################
    20/46: lib64gsturidownloader1.0_0
                                 ###################################################################################
    21/46: gstreamer1.0-plugins-bad
                                 ###################################################################################
    22/46: lib64gstplayer1.0_0   ###################################################################################
    23/46: gstreamer1.0-plugins-good
                                 ###################################################################################
    24/46: gstreamer1.0-vaapi    ###################################################################################
    25/46: gstreamer1.0-wavpack  ###################################################################################
    26/46: gstreamer1.0-faad     ###################################################################################
    27/46: gstreamer1.0-flac     ###################################################################################
    28/46: gstreamer1.0-twolame  ###################################################################################
    29/46: gstreamer1.0-x265     ###################################################################################
    30/46: gstreamer1.0-mpeg     ###################################################################################
    31/46: gstreamer1.0-cdio     ###################################################################################
    32/46: gstreamer1.0-speex    ###################################################################################
    33/46: gstreamer1.0-dv       ###################################################################################
    34/46: gstreamer1.0-gsm      ###################################################################################
    35/46: gstreamer1.0-rtmp     ###################################################################################
    36/46: gstreamer1.0-a52dec   ###################################################################################
    37/46: gstreamer1.0-cdparanoia
                                 ###################################################################################
    38/46: gstreamer1.0-pulse    ###################################################################################
    39/46: gstreamer1.0-lame     ###################################################################################
    40/46: gstreamer1.0-plugins-ugly
                                 ###################################################################################
    41/46: gstreamer1.0-libav    ###################################################################################
    42/46: lib64gsttranscoder1.0_0
                                 ###################################################################################
    43/46: gstreamer1.0-gme      ###################################################################################
    44/46: lib64bluez3           ###################################################################################
    45/46: qemu-user-binfmt      ###################################################################################
    46/46: bluez                 ###################################################################################

Assigning this to QA. Giuseppe, if this isn't ready yet, please change it back.

Testers, be aware that there are tainted and non-tainted versions of several of these packages. Both need to be tested.

Assignee: pkg-bugs => qa-bugs

Merry thanks for the update, works great in Cauldron.

CC: (none) => xerxes2

Here 
https://www.zerodayinitiative.com/advisories/ZDI-23-1007/ 
and here
https://www.zerodayinitiative.com/advisories/ZDI-23-1008/

I see that ZDI-CAN-21443 = CVE-2023-38103
and ZDI-CAN-21444 =  CVE-2023-38104

I'll add those CVEs to the advisory instead of the ZDI-CAN numbers, but I can change that if that's wrong ;-)

(In reply to Giuseppe Ghibò from comment #16)
> Created attachment 14228 [details]
> List of gstreamer-1.22.8 packages
> 
> Here is an updated list of files for gstreamer-1.22.8 that supersedes for
> 1.22.5.

Used that list to create an advisory, it can be seen here:
https://svnweb.mageia.org/advisories/32071.adv?view=markup&pathrev=15438

I really hope I didn't miss a SRPM, feel free to check and remove the advisory keyword when something is wrong.

Keywords: (none) => advisory

(In reply to Marja Van Waes from comment #20)
> Here 
> https://www.zerodayinitiative.com/advisories/ZDI-23-1007/ 
> and here
> https://www.zerodayinitiative.com/advisories/ZDI-23-1008/
> 
> I see that ZDI-CAN-21443 = CVE-2023-38103
> and ZDI-CAN-21444 =  CVE-2023-38104
> 
> I'll add those CVEs to the advisory instead of the ZDI-CAN numbers, but I
> can change that if that's wrong ;-)

Ok.

There are also more beside the initial CVEs, see:

https://gstreamer.freedesktop.org/security/

it should be fixed up to the AV1 (gstreamer security advisory 2023-0011).

(In reply to Giuseppe Ghibò from comment #22)

> 
> There are also more beside the initial CVEs, see:
> 
> https://gstreamer.freedesktop.org/security/
> 
> it should be fixed up to the AV1 (gstreamer security advisory 2023-0011).

I'll have a look

(In reply to Marja Van Waes from comment #23)
> (In reply to Giuseppe Ghibò from comment #22)
> 
> > 
> > There are also more beside the initial CVEs, see:
> > 
> > https://gstreamer.freedesktop.org/security/
> > 
> > it should be fixed up to the AV1 (gstreamer security advisory 2023-0011).
> 
Up to, but not including? Or up to and including?

(In reply to Marja Van Waes from comment #24)
> (In reply to Marja Van Waes from comment #23)
> > (In reply to Giuseppe Ghibò from comment #22)
> > 
> > > 
> > > There are also more beside the initial CVEs, see:
> > > 
> > > https://gstreamer.freedesktop.org/security/
> > > 
> > > it should be fixed up to the AV1 (gstreamer security advisory 2023-0011).
> > 
> Up to, but not including? Or up to and including?

Up and including. Latest fix included in 1.22.8 is this:

https://gstreamer.freedesktop.org/security/sa-2023-0011.html

(In reply to Giuseppe Ghibò from comment #25)

> 
> Up and including. Latest fix included in 1.22.8 is this:
> 
> https://gstreamer.freedesktop.org/security/sa-2023-0011.html

Thanks :-)
Added, the current advisory can be seen here:
https://svnweb.mageia.org/advisories/32071.adv?view=markup&pathrev=15443

(For those who don't know: the links to the CVEs will be automatically added to the references by the scripts that our sysadmins use when pushing a package to updates)

I think I got all the rpms into qarepo - with the attached list formatted as it is, a simple copy-and-paste operation isn't easy, and it would be easy to miss one or two of them. Moving on...

I discovered that contrary to my former belief, updating to just the non-tainted packages does not remove the old tainted packages, at least with gstreamer. This means that in order to make a proper test of a non-tainted gstreamer, one needs a fully non-tainted MGA9 install. I have a VirtualBox guest I created for just this sort of situation, so...

MGA9-64 Plasma, in VirtualBox. The tainted repos have never been activated in this guest. Testing with Parole, by playing videos that use the Xvid, x.264, and x.265 codecs. All three videos played without errors. 

On real hardware, MGA9-64 Plasma on an i5-2500, integrated Intel graphics(i915 driver). Gathered what I hope is all the rpms into qarepo, and updated. Played the same three videos with Parole, again with no errors.

It appears to be OK, but just to be sure I will try it with some AMD hardware in the morning.

With all these CVEs I decided to keep going tonight, and tested the ainted version with my HP Pavilion 15, A8-4555 APU, with HD 7600G graphics, MGA9-64 Plasma system.

No installation issues. I played some x264 and x265 videos in Parole, all played without issues.

This has been sitting here too long now. These security holes need to be plugged. Giving it an OK, and validating.

Whiteboard: (none) => MGA9-64-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0354.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED