Bug 32272

Summary:	erofs-utils new security issues CVE-2023-3355[12]
Product:	Mageia	Reporter:	Nicolas Salguero <nicolas.salguero>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, geiger.david68210, herman.viaene, nicolas.salguero, sysadmin-bugs, tablackwell
Version:	9	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA9-64-OK
Source RPM:	erofs-utils-1.5-1.mga9.src.rpm	CVE:	CVE-2023-33551,CVE-2023-33552
Status comment:	Fixed in v1.6.3

Description Nicolas Salguero 2023-09-11 14:09:05 CEST

Fedora has issued an advisory on September 7:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FHOIRL6XH5NYR3LYI3KP5DE4SDSQWR7W/

Mageia 8 and 9 are also affected.

Nicolas Salguero 2023-09-11 14:09:38 CEST

Source RPM: (none) => erofs-utils-1.5-1.mga9.src.rpm
Whiteboard: (none) => MGA9TOO, MGA8TOO
CC: (none) => nicolas.salguero

Comment 1 Lewis Smith 2023-09-12 21:13:18 CEST

Version : 1.6.3 "- Backport patches for CVE-2023-33551 and CVE-2023-33552."

Thierry is the clear committer for this pkg, so assigning to you.

Status comment: (none) => Fixed in v1.6.3
Assignee: bugsquad => thierry.vignaud

Comment 2 David GEIGER 2024-06-15 11:02:46 CEST

Removing Mageia 8 from whiteboard due to EOL!

Whiteboard: MGA9TOO, MGA8TOO => MGA9TOO
CC: (none) => geiger.david68210

Comment 3 David GEIGER 2024-06-15 12:12:24 CEST

Done for both mga9 and Cauldron!

Packages in9/Core/Updates_testing:
======================
erofs-fuse-1.7.1-1.mga9
erofs-utils-1.7.1-1.mga9

From SRPMS:
erofs-utils-1.7.1-1.mga9.src.rpm

Assignee: thierry.vignaud => qa-bugs
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9

katnatek 2024-06-15 19:47:15 CEST

CVE: (none) => CVE-2023-33551,CVE-2023-33552

katnatek 2024-06-15 19:52:26 CEST

Keywords: (none) => advisory

Comment 4 Tony Blackwell 2024-06-15 22:59:29 CEST

M9: I'm only seeing v 1.5.
What repository is it in?

CC: (none) => tablackwell

Comment 5 Tony Blackwell 2024-06-15 23:00:41 CEST

NOt appeared in core updates testing yet?

Comment 6 Tony Blackwell 2024-06-15 23:13:12 CEST

changed my mirror to Princeton.  Installed 1.7.1 

erofsfuse runs, but I don't have a Huawei phone or other erofs filesystem to test it on

Comment 7 Herman Viaene 2024-06-16 11:34:42 CEST

From googling I get the idea that you don't need a phone to run the commands, but I cann't get my head around what the commands expact as source or destination. I find no simple example to follow.

CC: (none) => herman.viaene

Comment 8 katnatek 2024-06-26 21:00:15 CEST

RH mageia 9 x86_64

LC_ALL=C urpmi erofs-fuse erofs-utils

    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/erofs-utils-1.5-1.mga9.x86_64.rpm
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/erofs-fuse-1.5-1.mga9.x86_64.rpm               
installing erofs-utils-1.5-1.mga9.x86_64.rpm erofs-fuse-1.5-1.mga9.x86_64.rpm from /var/cache/urpmi/rpms                            
Preparing...                     ##################################################################################################
      1/2: erofs-fuse            ##################################################################################################
      2/2: erofs-utils           ##################################################################################################

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (32-bit)" is up-to-date
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing erofs-fuse-1.7.1-1.mga9.x86_64.rpm erofs-utils-1.7.1-1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: erofs-utils           ##################################################################################################
      2/2: erofs-fuse            ##################################################################################################
      1/2: removing erofs-utils-1.5-1.mga9.x86_64
                                 ##################################################################################################
      2/2: removing erofs-fuse-1.5-1.mga9.x86_64
                                 ##################################################################################################

Give OK in base a clean install

LC_ALL=C urpme erofs-fuse erofs-utils
removing erofs-fuse-1.7.1-1.mga9.x86_64 erofs-utils-1.7.1-1.mga9.x86_64
removing package erofs-fuse-1.7.1-1.mga9.x86_64
      1/2: removing erofs-fuse-1.7.1-1.mga9.x86_64
                                 ##################################################################################################
removing package erofs-utils-1.7.1-1.mga9.x86_64
      2/2: removing erofs-utils-1.7.1-1.mga9.x86_64
                                 ##################################################################################################

And uninstall

Whiteboard: (none) => MGA9-64-OK
CC: (none) => andrewsfarm

Comment 9 Thomas Andrews 2024-06-28 03:49:23 CEST

Validating.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 10 Mageia Robot 2024-06-28 04:42:15 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0241.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED