Fedora has issued an advisory on March 9: https://lists.fedoraproject.org/pipermail/package-announce/2015-March/152366.html They fixed it by updating to librsync 1.0.0. This is an incompatible change, and furthermore it appears to change the SONAME, so they had to rebuild rdiff-backup and duplicity: https://lists.fedoraproject.org/pipermail/package-announce/2015-March/152368.html https://lists.fedoraproject.org/pipermail/package-announce/2015-March/152365.html Mageia 4 and Mageia 5 are affected. Reproducible: Steps to Reproduce:
Whiteboard: (none) => MGA5TOO, MGA4TOO
rdiff-1.0.0-1.mga4.i586 librsync-debuginfo-1.0.0-1.mga4.x86_64 librsync1-1.0.0-1.mga4.i586 librsync-devel-1.0.0-1.mga4.i586 librsync-debuginfo-1.0.0-1.mga4.i586 lib64rsync1-1.0.0-1.mga4.x86_64 lib64rsync-devel-1.0.0-1.mga4.x86_64 rdiff-1.0.0-1.mga4.x86_64 from librsync-1.0.0-1.mga4.src duplicity-debuginfo-0.6.22-5.1.mga4.x86_64 duplicity-0.6.22-5.1.mga4.i586 duplicity-0.6.22-5.1.mga4.x86_64 duplicity-debuginfo-0.6.22-5.1.mga4.i586 from duplicity-0.6.22-5.1.mga4.src rdiff-backup-1.3.3-8.1.mga4.i586 rdiff-backup-debuginfo-1.3.3-8.1.mga4.i586 rdiff-backup-1.3.3-8.1.mga4.x86_64 rdiff-backup-debuginfo-1.3.3-8.1.mga4.x86_64 from rdiff-backup-1.3.3-8.1.mga4.src Freeze push asked in Cauldron
Updated packages uploaded for Mageia 4 and Cauldron. Thanks Philippe! Package list in Comment 1. Advisory: ======================== Updated librsync packages fix security vulnerability: librsync before 1.0.0 used a truncated MD4 "strong" check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part of a file could use it to control other regions of the file, if it's transferred using librsync/rdiff (CVE-2014-8242). The change to fix this is not backward compatible with older versions of librsync. Backward compatibility can be obtained using the new `rdiff sig --hash=md4` option or through specifying the "signature magic" in the API, but this should not be used when either the old or new file contain untrusted data. Also, any applications that use the librsync library will need to be recompiled against the updated library. The duplicity and rdiff-backup packages have been rebuilt for this reason. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8242 https://lists.fedoraproject.org/pipermail/package-announce/2015-March/152366.html
CC: (none) => makowski.mageiaVersion: Cauldron => 4Assignee: makowski.mageia => qa-bugsWhiteboard: MGA5TOO, MGA4TOO => (none)
Hold that. http://svnweb.mageia.org/packages/cauldron/librsync/current/SPECS/librsync.spec?r1=744308&r2=819079 Fixed with: http://svnweb.mageia.org/packages/updates/4/librsync/current/SPECS/librsync.spec?r1=819803&r2=819802&pathrev=819803
CC: (none) => oe
Ahh, good catch, but it should *not* obsolete librsync1.
It was to remove the faulty lib[64]rsync1-1.0.0-1 package. Less work for mga I think.
The sysadmins have a script that automatically cleans out orphaned packages like old libs.
Is this one needing more work?
(In reply to claire robinson from comment #7) > Is this one needing more work? Yep. The work is done actually, just waiting for a freeze push in Cauldron. Then I'll push an updated librsync-1.0.0-2.2.mga4 to updates_testing. feedback'ing this one for now.
Whiteboard: (none) => feedback
librsync rebuilt with Oden's fix. librsync2-1.0.0-2.2.mga4 librsync-devel-1.0.0-2.2.mga4 rdiff-1.0.0-2.2.mga4 from librsync-1.0.0-2.2.mga4.src.rpm
Whiteboard: feedback => (none)
So current package list appears to be: librsync2-1.0.0-2.2.mga4 librsync-devel-1.0.0-2.2.mga4 rdiff-1.0.0-2.2.mga4 from librsync-1.0.0-2.2.mga4.src.rpm duplicity-0.6.22-5.1.mga4 from duplicity-0.6.22-5.1.mga4.src.rpm rdiff-backup-1.3.3-8.1.mga4 from rdiff-backup-1.3.3-8.1.mga4.src.rpm
Testing complete mga4 64 Using duplicity.. $ ls test TFPA-2014-002-less-oob.gif TFPA-2014-002-less-oob-no-lesspipe.bin $ duplicity ~/test scp://192.168.100.5/test Import of duplicity.backends.dpbxbackend Failed: No module named dropbox Local and Remote metadata are synchronized, no sync needed. Last full backup date: none GnuPG passphrase: Retype passphrase to confirm: No signatures found, switching to full backup. --------------[ Backup Statistics ]-------------- StartTime 1429008439.62 (Tue Apr 14 11:47:19 2015) EndTime 1429008439.63 (Tue Apr 14 11:47:19 2015) ElapsedTime 0.01 (0.01 seconds) SourceFiles 3 SourceFileSize 4608 (4.50 KB) NewFiles 3 NewFileSize 4608 (4.50 KB) DeletedFiles 0 ChangedFiles 0 ChangedFileSize 0 (0 bytes) ChangedDeltaSize 0 (0 bytes) DeltaEntries 3 RawDeltaSize 512 (512 bytes) TotalDestinationSizeChange 287 (287 bytes) Errors 0 ------------------------------------------------- Verify the backup.. $ duplicity verify scp://192.168.100.5/test ~/test Import of duplicity.backends.dpbxbackend Failed: No module named dropbox Local and Remote metadata are synchronized, no sync needed. Last full backup date: Tue Apr 14 11:47:15 2015 GnuPG passphrase: Verify complete: 3 files compared, 0 differences found. Accidentally delete the local files and replace them from the backup.. $ rm -rf test $ ls test ls: cannot access test: No such file or directory Oops.. restoring from the backup.. $ duplicity restore scp://192.168.100.5/test ~/test Import of duplicity.backends.dpbxbackend Failed: No module named dropbox Local and Remote metadata are synchronized, no sync needed. Last full backup date: Tue Apr 14 11:47:15 2015 GnuPG passphrase: $ ls test TFPA-2014-002-less-oob.gif TFPA-2014-002-less-oob-no-lesspipe.bin Phew! Using rdiff-backup... rdiff-backup requires rdiff-backup to be installed on the remote machine so just testing it works with two local directories. $ ls test TFPA-2014-002-less-oob.gif TFPA-2014-002-less-oob-no-lesspipe.bin $ ls test2 ls: cannot access test2: No such file or directory Backing up test into test2.. $ ls test TFPA-2014-002-less-oob.gif TFPA-2014-002-less-oob-no-lesspipe.bin $ ls test2 rdiff-backup-data/ TFPA-2014-002-less-oob.gif TFPA-2014-002-less-oob-no-lesspipe.bin Accidentally delete test and restore it from the backup.. $ rm -rf ~/test $ ls test ls: cannot access test: No such file or directory Oops! $ rdiff-backup --restore-as-of now ~/test2 ~/test $ ls test TFPA-2014-002-less-oob.gif TFPA-2014-002-less-oob-no-lesspipe.bin
Whiteboard: (none) => has_procedure mga4-64-ok
Validating. Advisory uploaded. Please push to 4 updates Thanks
Keywords: (none) => validated_updateWhiteboard: has_procedure mga4-64-ok => has_procedure advisory mga4-64-okCC: (none) => sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0146.html
Status: NEW => RESOLVEDResolution: (none) => FIXED