Bug 33132

Summary:	python-idna new security issue CVE-2024-3651
Product:	Mageia	Reporter:	Nicolas Salguero <nicolas.salguero>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, herman.viaene, sysadmin-bugs, yvesbrungard
Version:	9	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA9-64-OK
Source RPM:	python-idna-3.4-2.mga9.src.rpm	CVE:	CVE-2024-3651
Status comment:

Description Nicolas Salguero 2024-04-23 15:41:53 CEST

Fedora has issued an advisory on April 23:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QKQPAXBXFNOVCI2IKRUG56LWQVB6H64Y/

The issue is fixed in version 3.7.

Mageia 9 is also affected.

Nicolas Salguero 2024-04-23 15:42:18 CEST

Source RPM: (none) => python-idna-3.4-3.mga10.src.rpm
Status comment: (none) => Fixed upstream in 3.7
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2024-3651

Comment 1 Lewis Smith 2024-04-24 21:18:02 CEST

(On an M9 system, I can only see version 3.3 in Cauldron).

No one packager obvious for this RPM, so assigning to Python people.

Assignee: bugsquad => python

Comment 2 papoteur 2024-06-27 18:01:04 CEST

Cauldron updated to 3.7

Whiteboard: MGA9TOO => (none)
CC: (none) => yvesbrungard
Version: Cauldron => 9
Source RPM: python-idna-3.4-3.mga10.src.rpm => python-idna-3.4-2.mga9.src.rpm

Comment 3 papoteur 2024-06-28 08:34:26 CEST

Submitting:
RPMS:
python3-idna-3.7-1.mga9.noarch
SRPMS:
python-idna-3.7-1.mga9

Status comment: Fixed upstream in 3.7 => (none)
Assignee: python => qa-bugs

katnatek 2024-06-29 01:10:17 CEST

Keywords: (none) => advisory

Comment 4 Herman Viaene 2024-06-29 10:53:18 CEST

MGA9-64  Plasma Wayland on  HP-Pavillion.
No installation issues.
Looking for som testing
# urpmq --whatrequires python3-idna
python3-anyio
python3-cobaya
python3-email-validator
python3-hyperlink
python3-idna
python3-jsonschema+format
python3-jsonschema+format-nongpl
python3-nbxmpp
python3-requests
python3-requests
python3-requests
python3-rfc3986+idna2008
python3-trio
python3-trustme
python3-twisted+tls
python3-yarl
syslog-ng-python-modules
So seems deep in developers territory.
]# urpmq --whatrequires-recursive python3-idna

returns somethinh like 15 screenlenghts of packages....
Giving the OK on clean install and good behavior as we often do for developers stuff.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Comment 5 Thomas Andrews 2024-06-29 20:41:10 CEST

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 6 Mageia Robot 2024-07-01 19:55:13 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0245.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED