Bug 11497 - libguestfs new security issue CVE-2013-4419
Summary: libguestfs new security issue CVE-2013-4419
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Joseph Wang
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/571976/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-19 18:03 CEST by David Walser
Modified: 2013-10-28 22:24 CET (History)
1 user (show)

See Also:
Source RPM: libguestfs-1.23.31-1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2013-10-19 18:03:25 CEST
Upstream has announced a security issue on October 17:
https://www.redhat.com/archives/libguestfs/2013-October/msg00031.html

The announcement contains a patch.

The issue is fixed in 1.24, as indicated in the RedHat bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1016960

Reproducible: 

Steps to Reproduce:
Comment 1 Joseph Wang 2013-10-21 10:04:50 CEST
Fix uploaded to cauldron.  Freeze push requested.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 2 David Walser 2013-10-21 18:56:25 CEST
It has not yet been uploaded, reopening.  We can close when it's pushed.

Status: RESOLVED => REOPENED
Resolution: FIXED => (none)

Comment 3 David Walser 2013-10-23 17:41:51 CEST
Thomas did push this in Cauldron, but the build failed (due to an unpackaged man page):
http://pkgsubmit.mageia.org/uploads/failure/cauldron/core/release/20131023142712.tmb.valstar.6033/log/libguestfs-1.24.0-2.mga4/build.0.20131023142726.log

Also, I noticed in the build log a "supermin" command that looks like it's downloading a bunch of packages.  If I'm not mistaken, package builds shouldn't download things.  It looks like it's just Mageia packages it downloaded, so with proper BuildRequires I'd think it should be able to get the files it needs directly from the build chroot.

CC: (none) => tmb

Comment 4 David Walser 2013-10-23 18:40:40 CEST
Ok, it's built now and uploaded in libguestfs-1.24.0-2.mga4.

Status: REOPENED => RESOLVED
Resolution: (none) => FIXED

Comment 5 Joseph Wang 2013-10-23 19:12:48 CEST
The problem with putting in buildrequires is that libguestfs calls supermin which calls urpmi to install the rpm onto the virtual guest disk.  A build requires would unpack the rpms into the chroot environment, but not the virtual disk which is created by libguestfs.

Assuming that everything works the way that I think it does, the supermin actually doesn't download the rpm's from the network, but from the build cache.
David Walser 2013-10-28 22:24:21 CET

URL: (none) => http://lwn.net/Vulnerabilities/571976/


Note You need to log in before you can comment on or make changes to this bug.