Debian has issued an advisory on July 2: https://www.debian.org/security/2016/dsa-3613 It was fixed upstream in 2.0.0. Upstream's advisory links to fixes: http://security.libvirt.org/2016/0001.html Mageia 5 is also affected.
Assignee: bugsquad => thierry.vignaudWhiteboard: (none) => MGA5TOO
Patched packages uploaded for Mageia 5 and Cauldron. Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=14192#c7 Advisory: ======================== Updated libvirt packages fix security vulnerability: Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library. When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user to connect, despite the documentation declaring that setting an empty password for the VNC server prevents all client connections. With this update the behaviour is enforced by setting the password expiration to "now" (CVE-2016-5008). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5008 http://security.libvirt.org/2016/0001.html https://www.debian.org/security/2016/dsa-3613 ======================== Updated packages in core/updates_testing: ======================== libvirt0-1.2.9.3-1.4.mga5 libvirt-devel-1.2.9.3-1.4.mga5 libvirt-utils-1.2.9.3-1.4.mga5 from libvirt-1.2.9.3-1.4.mga5.src.rpm
Version: Cauldron => 5Assignee: thierry.vignaud => qa-bugsWhiteboard: MGA5TOO => has_procedure
Testing on mga5-64 already installed: qemu-2.4.1-5.mga5 qemu-img-2.4.1-5.mga5 virt-manager-1.1.0-7.mga5 installed from testing: lib64virt0-1.2.9.3-1.4.mga5 libvirt-utils-1.2.9.3-1.4.mga5 packages installed cleanly launched libvirtd.service: # systemctl start libvirtd.service Used virt-manager to create a VM and launched install of mga5 using boot.iso OK for mga5-64
CC: (none) => jimWhiteboard: has_procedure => has_procedure MGA5-64-OK
Testing on mga5-32 already installed: qemu-img-2.4.1-5.mga5 qemu-2.4.1-5.mga5 virt-manager-1.1.0-7.mga5 installed from testing: libvirt0-1.2.9.3-1.4.mga5 libvirt-utils-1.2.9.3-1.4.mga5 packages installed cleanly launched libvirtd.service # systemctl start libvirtd.service Used virt-manager to create a VM and launched installation of mga5 using boot.iso OK for mga5-32
Whiteboard: has_procedure MGA5-64-OK => has_procedure MGA5-64-OK MGA5-32-OK
This is now validated The Advisory needs to be uploaded to SVN The packages can then be pushed to updates
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Whiteboard: has_procedure MGA5-64-OK MGA5-32-OK => has_procedure advisory MGA5-64-OK MGA5-32-OK
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0248.html
Status: NEW => RESOLVEDResolution: (none) => FIXED