Bug 15794 - curl new security issue CVE-2015-3153
Summary: curl new security issue CVE-2015-3153
Status: RESOLVED WONTFIX
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Shlomi Fish
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/642638/
Whiteboard: OK
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-29 18:48 CEST by David Walser
Modified: 2015-05-11 00:21 CEST (History)
2 users (show)

See Also:
Source RPM: curl-7.34.0-1.6.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2015-04-29 18:48:38 CEST
Upstream has issued an advisory today (April 29):
http://curl.haxx.se/docs/adv_20150429.html

The issue is fixed in 7.42.1, and there is a patch available.

The patch applies cleanly in curl 7.40.0 in Cauldron.  That is committed in SVN and a freeze push has been requested.

The patch doesn't even remotely begin to apply to 7.34.0 in Mageia 4.  We'll have to wait for someone to do a backported fix.

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2015-04-30 19:04:01 CEST
Debian and Ubuntu have issued advisories for this on April 29 and 30:
https://www.debian.org/security/2015/dsa-3240
http://www.ubuntu.com/usn/usn-2591-1/

Debian has not fixed the issue in Wheezy, nor has Ubuntu fixed it for older versions.  It appears, due to the invasive changes in 7.37.0 that the fixes rely on, Debian and Ubuntu will not be backporting fixes to versions older than that.  Indeed, Ubuntu's CVE page for this suggests just that:
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3153.html

In all likelihood, we won't be fixing this for Mageia 4 either.

URL: (none) => http://lwn.net/Vulnerabilities/642638/

Comment 2 David Walser 2015-04-30 23:57:01 CEST
curl-7.40.0-3.mga5 uploaded for Cauldron.
Sander Lepik 2015-05-03 17:16:44 CEST

CC: (none) => mageia
Hardware: i586 => All
Assignee: bugsquad => shlomif

Shlomi Fish 2015-05-07 15:40:42 CEST

Whiteboard: (none) => OK

Comment 3 Nicolas Lécureuil 2015-05-11 00:21:17 CEST
closing as wontfix for mga4 then

Status: NEW => RESOLVED
CC: (none) => mageia
Resolution: (none) => WONTFIX


Note You need to log in before you can comment on or make changes to this bug.