Bug 19718 - resteasy new security issue CVE-2016-7050
Summary: resteasy new security issue CVE-2016-7050
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/705572/
Whiteboard: MGA5-64-OK MGA5-32-OK advisory
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-11-04 16:08 CET by David Walser
Modified: 2016-11-17 17:37 CET (History)
7 users (show)

See Also:
Source RPM: resteasy-3.0.6-23.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-11-04 16:08:24 CET
RedHat has issued an advisory on November 3:
https://rhn.redhat.com/errata/RHSA-2016-2604.html

Theirs refers to an SRPM called resteasy-base, but the information on the security issue says resteasy, so I'm not sure, but we may be affected.
David Walser 2016-11-04 16:08:35 CET

Whiteboard: (none) => MGA5TOO

Comment 1 David GEIGER 2016-11-04 16:33:30 CET
According to fedora bugzilla this seems fixed in 3.0.17 release:

https://bugzilla.redhat.com/show_bug.cgi?id=1378613

CC: (none) => geiger.david68210

Comment 2 David GEIGER 2016-11-04 18:20:11 CET
Fixed on Cauldron with 3.0.17 updated version.

But for mga5 as our current java stack is now pretty out of date (based on fc 21 that is no more supported by fedora themselves) I don't know how to fix this security.
David Walser 2016-11-04 19:03:23 CET

Version: Cauldron => 5
Whiteboard: MGA5TOO => (none)

Comment 3 Marja Van Waes 2016-11-04 23:40:49 CET
(In reply to David GEIGER from comment #2)
> Fixed on Cauldron with 3.0.17 updated version.
> 
> But for mga5 as our current java stack is now pretty out of date (based on
> fc 21 that is no more supported by fedora themselves) I don't know how to
> fix this security.

@ neoclust

wdyt?

CC: (none) => marja11
Assignee: bugsquad => mageia

Comment 4 Nicolas Lécureuil 2016-11-16 16:35:54 CET
is is now on david hand, i explained him on irc how i think we can fix :)
Nicolas Lécureuil 2016-11-16 16:36:10 CET

Assignee: mageia => geiger.david68210

Comment 5 David GEIGER 2016-11-16 17:32:30 CET
Fixed now for mga5 too!
Nicolas Lécureuil 2016-11-16 17:37:39 CET

CC: (none) => mageia
Assignee: geiger.david68210 => qa-bugs

Comment 6 David Walser 2016-11-16 19:08:25 CET
Advisory:
========================

Updated resteasy packages fix security vulnerability:

It was discovered that under certain conditions RESTEasy could be forced to
parse a request with SerializableProvider, resulting in deserialization of
potentially untrusted data. An attacker could possibly use this flaw to execute
arbitrary code with the permissions of the application using RESTEasy
(CVE-2016-7050).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7050
https://rhn.redhat.com/errata/RHSA-2016-2604.html
========================

Updated packages in core/updates_testing:
========================
resteasy-3.0.6-3.1.mga5
resteasy-javadoc-3.0.6-3.1.mga5

from resteasy-3.0.6-3.1.mga5.src.rpm
Comment 7 Herman Viaene 2016-11-17 15:21:24 CET
MGA5-32 on Acer D620 Xfce
No installation issues
Referring to bug 13870, this should be enough to OK the update (having googled in vain to find a simple testcase).

CC: (none) => herman.viaene
Whiteboard: (none) => MGA5-32-OK

Comment 8 James Kerr 2016-11-17 15:38:26 CET
Testing on mga5-64

The packages and 300+ dependencies installed cleanly

$ rpm -q resteasy resteasy-javadoc
resteasy-3.0.6-3.1.mga5
resteasy-javadoc-3.0.6-3.1.mga5

I can't find a practical way to test this application and a clean install of the previous resteasy security update was deemed an adequate test:  https://bugs.mageia.org/show_bug.cgi?id=13870#c3
and so:

OK for mga5-64

CC: (none) => jim
Whiteboard: MGA5-32-OK => MGA5-64-OK

Comment 9 James Kerr 2016-11-17 15:41:26 CET
Restoring Herman's OK for mga5-32. It was removed somehow following the "mid-air collision"

Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK

Comment 10 James Kerr 2016-11-17 15:52:56 CET
This update is now validated
The Advisory in comment#6 needs to be uploaded to SVN
The packages can then be pushed to updates

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 11 Lewis Smith 2016-11-17 16:33:50 CET
Advisory from Comment 6 SVN'd.

CC: (none) => lewyssmith
Whiteboard: MGA5-64-OK MGA5-32-OK => MGA5-64-OK MGA5-32-OK advisory

Comment 12 Mageia Robot 2016-11-17 17:37:47 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0382.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.