Bug 19502 - pacemaker new security issue CVE-2016-7797
Summary: pacemaker new security issue CVE-2016-7797
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Anne Nicolas
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/705570/
Whiteboard: MGA5TOO
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-01 16:29 CEST by David Walser
Modified: 2016-11-04 15:59 CET (History)
1 user (show)

See Also:
Source RPM: pacemaker-1.1.8-10.mga6.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2016-10-01 16:29:19 CEST 
A CVE has been assigned for security issue fixed upstream in pacemaker:
http://openwall.com/lists/oss-security/2016/10/01/1

The commit to fix the issue is linked in the message above.  It is also fixed in 1.1.15.
David Walser 2016-10-01 16:29:30 CEST

Whiteboard: (none) => MGA5TOO

Comment 1 David GEIGER 2016-10-29 19:13:09 CEST 
looks like our current packages are not affected with this CVE because there isn't any file named "tls_backend.c" in source from 1.1.8 release:

https://github.com/ClusterLabs/pacemaker/commit/5ec24a2642bd0854b884d1a9b51d12371373b410

CC: (none) => geiger.david68210

Comment 2 David Walser 2016-10-29 19:27:41 CEST 
Is the affected code in another source file?  That happens sometimes.
Comment 3 David GEIGER 2016-10-29 19:37:54 CEST 
Nop, any other source files that contains this affected code.
Comment 4 David Walser 2016-10-29 19:39:10 CEST 
Cool, thanks.

Status: NEW => RESOLVED
Resolution: (none) => INVALID

Comment 5 David Walser 2016-11-04 15:59:13 CET 
There's also CVE-2016-7035:
http://lwn.net/Vulnerabilities/705571/

which only affects versions 1.1.10 and newer:
http://openwall.com/lists/oss-security/2016/11/03/5

So we're also not affected.

URL: (none) => http://lwn.net/Vulnerabilities/705570/
Note You need to log in before you can comment on or make changes to this bug.