Bug 19717 - libvirt new security issue CVE-2015-5160
Summary: libvirt new security issue CVE-2015-5160
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: All Packagers
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/705568/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-11-04 15:56 CET by David Walser
Modified: 2017-06-15 02:35 CEST (History)
5 users (show)

See Also:
Source RPM: libvirt-1.3.5-4.mga6.src.rpm
CVE: CVE-2015-5160
Status comment:


Attachments

Description David Walser 2016-11-04 15:56:25 CET
RedHat has issued an advisory on November 3:
https://rhn.redhat.com/errata/RHSA-2016-2577.html

We have already fixed the other two CVEs, and in all likelihood have already included an upstream fix for this CVE, but we should confirm this as we haven't seen this one yet.
David Walser 2016-11-04 15:56:32 CET

Whiteboard: (none) => MGA5TOO

Comment 1 Marja Van Waes 2016-11-04 23:43:18 CET
Assigning to all packagers collectively, since there is no registered maintainer for this package.

However, tv touched it more than 70 times.... Thierry, are you the de facto maintainer?

CC: (none) => marja11, thierry.vignaud
Assignee: bugsquad => pkg-bugs

Nicolas Lécureuil 2017-04-27 14:00:17 CEST

CVE: (none) => CVE-2015-5160
CC: (none) => mageia

Comment 2 Nicolas Lécureuil 2017-05-04 00:15:26 CEST
would be simpler to update libvirt. 

can we do this ?
Comment 3 David Walser 2017-05-04 03:30:21 CEST
Given that we're not running a maintenance release in Cauldron currently, I see no reason we can't update it.
Comment 4 Mike Rambo 2017-05-25 16:34:07 CEST
Update to 3.3.0 has been committed for cauldron (and a Freeze push request sent).

CC: (none) => mrambo

Nicolas Lécureuil 2017-05-26 13:34:21 CEST

Version: Cauldron => 5
Whiteboard: MGA5TOO => (none)

Comment 5 Thomas Backlund 2017-05-26 18:36:34 CEST
I dont think we will fix CVE-2015-5160 for mga5 as it needs matching fixes in qemu, something that landed in qemu-2.6.0 (we have 2.4.1), and libvirt needs several fixes too for it to work... and given the fact as stated in:

https://bugzilla.redhat.com/show_bug.cgi?id=1245647#c2

"It has been public knowledge since 2011 that passing Ceph keys on the command line is undesirable:

https://www.redhat.com/archives/libvir-list/2011-November/msg00853.html"


I agree with RHEL6:
https://bugzilla.redhat.com/show_bug.cgi?id=1245647#c13

"Red Hat Product Security has rated this issue as having Moderate security
impact. This issue is not currently planned to be addressed in future
updates of Enterprise Linux 6."


And SuSe:
https://bugzilla.suse.com/show_bug.cgi?id=939348#c10

"Upstream is aware of this limitation. Not fixable directly. Users should exercise caution regarding ceph IDs leaked on the command line and adjust their security posture accordingly."

CC: (none) => tmb

Comment 6 Mike Rambo 2017-05-26 19:39:22 CEST
Thomas' note comes at a good time. The mga5 update is not being nearly as cooperative as the cauldron update was. All but one of the mga5 patches either no longer apply or have already been applied upstream. Parts of the REVERT patch do not apply at present but might be made to do so, other parts are ok as they are. But even with all the patches removed I have not been able to get 3.3.0 to build on top of the mga5 package. It is failing (file not found) on something wireshark/proto.h/glib.h related but I haven't figured out exactly why.

But I'm going to suspend the effort unless/until it is decided that the mga5 update does need to be done after all. Does that make this a Won't Fix?
Comment 7 David Walser 2017-05-26 20:03:35 CEST
I'm fine with WONTFIX here.  We can still update qemu in Cauldron though.
Comment 8 Mike Rambo 2017-06-14 20:29:56 CEST
Setting this bug to resolved. Cauldron libvirt has been updated and it has been decided not to fix mga5. Qemu has since been updated by tmb also.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 9 David Walser 2017-06-15 02:35:55 CEST
Well it can't be set to 5 and FIXED when we didn't fix it for 5.  We can either go FIXED and Cauldron or WONTFIX and 5.  Going with the former for now.

Version: 5 => Cauldron


Note You need to log in before you can comment on or make changes to this bug.