Bug 33127

Summary:	perl-Clipboard 0.29
Product:	Mageia	Reporter:	Nicolas Salguero <nicolas.salguero>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, sysadmin-bugs
Version:	9	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA9-64-OK
Source RPM:	perl-Clipboard-0.280.0-1.mga9.src.rpm	CVE:
Status comment:

Description Nicolas Salguero 2024-04-22 11:07:53 CEST

Fedora has issued an advisory on April 19:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2DZYNRKKZWBH3JDTQAGHHR5FXA5MIEI/

Version 0.29 fixes 'clipbrowse command execution with multi-line clipboard text including "| sh"'

Nicolas Salguero 2024-04-22 11:08:32 CEST

Source RPM: (none) => perl-Clipboard-0.280.0-1.mga9.src.rpm
Status comment: (none) => Fixed upstream in 0.29 (0.290.0)

Comment 1 Nicolas Salguero 2024-04-22 13:56:10 CEST

Suggested advisory:
========================

The updated package fixes 'clipbrowse command execution with multi-line clipboard text including "| sh"'.

References:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2DZYNRKKZWBH3JDTQAGHHR5FXA5MIEI/
========================

Updated package in core/updates_testing:
========================
perl-Clipboard-0.290.0-1.mga9

from SRPM:
perl-Clipboard-0.290.0-1.mga9.src.rpm

Status comment: Fixed upstream in 0.29 (0.290.0) => (none)
Status: NEW => ASSIGNED
Assignee: bugsquad => qa-bugs

Comment 2 katnatek 2024-04-22 20:34:00 CEST

RH mageia 9 x86_64

Searching about the issue I find a example

https://github.com/shlomif/Clipboard/issues/11

To make it works, first you must copy the 2 lines and in console run clipbrowse
This open https://www.example.com/ in browser and print p0wned in terminal

 LC_ALL=C urpmi --auto --auto-update 
medium "QA Testing (32-bit)" is up-to-date
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date


installing perl-Clipboard-0.290.0-1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: perl-Clipboard        ##################################################################################################
      1/1: removing perl-Clipboard-0.280.0-1.mga9.noarch
                                 ##################################################################################################

After the update, the same example produces an empty browser window and any output in console, so I guess is OK

Whiteboard: (none) => MGA9-64-OK
CC: (none) => andrewsfarm

katnatek 2024-04-22 20:40:07 CEST

Keywords: (none) => advisory

Comment 3 Thomas Andrews 2024-04-23 00:38:06 CEST

Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 4 Mageia Robot 2024-04-23 03:21:56 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0143.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED