Bug 18124 - mercurial new security issues CVE-2016-3068, CVE-2016-3069, and CVE-2016-3630
Summary: mercurial new security issues CVE-2016-3068, CVE-2016-3069, and CVE-2016-3630
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/682389/
Whiteboard: has_procedure advisory MGA5-32-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-04-04 23:32 CEST by David Walser
Modified: 2016-04-13 19:40 CEST (History)
3 users (show)

See Also:
Source RPM: mercurial-3.1.1-5.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-04-04 23:32:47 CEST
Slackware has issued an advisory on April 1:
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.527508

The issues are fixed upstream in 3.7.3 (already updated in Cauldron).

I don't have any more info about these issues or if they affect 3.1.1.
Comment 1 Philippe Makowski 2016-04-05 12:55:41 CEST
(In reply to David Walser from comment #0)
> I don't have any more info about these issues or if they affect 3.1.1.

I'll check with Debian, but for now, Debian did nothing for 3.1.2
https://security-tracker.debian.org/tracker/source-package/mercurial
Comment 2 Philippe Makowski 2016-04-05 13:05:44 CEST
(In reply to Philippe Makowski from comment #1)
> (In reply to David Walser from comment #0)
> > I don't have any more info about these issues or if they affect 3.1.1.
> 
> I'll check with Debian, but for now, Debian did nothing for 3.1.2
> https://security-tracker.debian.org/tracker/source-package/mercurial

seems that OpenSuse have the patches :
https://build.opensuse.org/request/show/384129
Comment 3 David Walser 2016-04-05 17:59:00 CEST
(In reply to Philippe Makowski from comment #1)
> (In reply to David Walser from comment #0)
> > I don't have any more info about these issues or if they affect 3.1.1.
> 
> I'll check with Debian, but for now, Debian did nothing for 3.1.2
> https://security-tracker.debian.org/tracker/source-package/mercurial

Debian has now patched 3.1.2:
https://www.debian.org/security/2016/dsa-3542
https://lists.debian.org/debian-security-announce/2016/msg00116.html

packages.debian.org and sources.debian.net haven't been updated yet though :-/
Comment 4 Philippe Makowski 2016-04-06 15:33:37 CEST
Several vulnerabilities have been discovered in Mercurial, a distributed
version control system. The Common Vulnerabilities and Exposures project
identifies the following issues:

CVE-2016-3068

    Blake Burkhart discovered that Mercurial allows URLs for Git
    subrepositories that could result in arbitrary code execution on
    clone.

CVE-2016-3069

    Blake Burkhart discovered that Mercurial allows arbitrary code
    execution when converting Git repositories with specially
    crafted names.

CVE-2016-3630

    It was discovered that Mercurial does not properly perform bounds-
    checking in its binary delta decoder, which may be exploitable for
    remote code execution via clone, push or pull.


Updated packages :
mercurial-3.1.1-5.1.mga5.i586
mercurial-3.1.1-5.1.mga5.x86_64

from :
mercurial-3.1.1-5.1.mga5.src

Refs :
https://bugs.mageia.org/show_bug.cgi?id=18124
https://www.debian.org/security/2016/dsa-3542
https://lists.debian.org/debian-security-announce/2016/msg00116.html
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.527508
http://lwn.net/Vulnerabilities/682389/

Assignee: makowski.mageia => security

Comment 5 David Walser 2016-04-06 17:00:56 CEST
Thanks Philippe!

Advisory:
========================

Updated mercurial packages fix security vulnerabilities:

Blake Burkhart discovered that Mercurial allows URLs for Git subrepositories
that could result in arbitrary code execution on clone (CVE-2016-3068).

Blake Burkhart discovered that Mercurial allows arbitrary code execution when
converting Git repositories with specially crafted names (CVE-2016-3069).

It was discovered that Mercurial does not properly perform bounds-checking in
its binary delta decoder, which may be exploitable for remote code execution
via clone, push or pull (CVE-2016-3630).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3068
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3069
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3630
https://www.debian.org/security/2016/dsa-3542

CC: (none) => makowski.mageia
Version: Cauldron => 5
Assignee: security => qa-bugs

Comment 6 Herman Viaene 2016-04-13 11:58:52 CEST
MGA5-32 on Acer D620 Xfce
No installation issues.
Tested as per bug 15590 Comment 4 , all works well.

CC: (none) => herman.viaene
Whiteboard: (none) => has_procedure MGA5-32-OK

Comment 7 claire robinson 2016-04-13 18:22:29 CEST
Well done Herman.

Validating. Advisory uploaded.

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA5-32-OK => has_procedure advisory MGA5-32-OK
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2016-04-13 19:40:03 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0138.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.