Upstream has issued an advisory today (August 1): http://openwall.com/lists/oss-security/2017/08/01/7 The issue is fixed upstream in 1.5. Mageia 5 and Mageia 6 are also affected.
Whiteboard: (none) => MGA6TOO, MGA5TOOCC: (none) => geiger.david68210
pushed in updates_testing for mageia6 src.rpm: apache-commons-email-1.3.1-10.1.mga6
pushed in updates_testing for mageia5 src.rpm: apache-commons-email-1.3.1-4.1.mga5
Assignee: mageia => qa-bugs
Not successfully built in Mageia 5 yet, but it is fixed in Cauldron now.
Version: Cauldron => 6Whiteboard: MGA6TOO, MGA5TOO => MGA5TOOAssignee: qa-bugs => mageiaCC: (none) => qa-bugs
build OK now
Advisory: ======================== Updated apache-commons-email packages fix security vulnerability: In apache-commons-email before 1.5, when a call-site passes a subject for an email that contains line-breaks, the caller can add arbitrary SMTP headers (CVE-2017-9801). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9801 http://openwall.com/lists/oss-security/2017/08/01/7 ======================== Updated packages in core/updates_testing: ======================== apache-commons-email-1.3.1-4.1.mga5 apache-commons-email-javadoc-1.3.1-4.1.mga5 apache-commons-email-1.3.1-10.1.mga6 apache-commons-email-javadoc-1.3.1-10.1.mga6 from SRPMS: apache-commons-email-1.3.1-4.1.mga5.src.rpm apache-commons-email-1.3.1-10.1.mga6.src.rpm
CC: qa-bugs => mageia
MGA5-32 on Asus A6000VM Xfce. No installation issues. Found example how to test this at https://commons.apache.org/proper/commons-email/userguide.html , but running this is beyond me. I suppose this is java, but using javac on it gives me all errors like: apachemail.java:3: error: class, interface, or enum expected Email email = new SimpleEmail();
CC: (none) => herman.viaene
Brave of you to tackle this Herman. Java requires a lot of commitment if you are not familiar with it. The last time I tried anything similar it required nearly a week's work and the very kind coaching of a Java expert on the mailing list. Those snippets would need some kind of jacket to work I think. Beyond me also. No PoC available so you would be best to simply pass this as installable. Thanks, and please leave some updates for the rest of us ;-)
CC: (none) => tarazed25
Whiteboard: MGA5TOO => MGA5TOO MGA5-32-OK
Whiteboard: MGA5TOO MGA5-32-OK => MGA5TOO MGA5-32-OK advisoryCC: (none) => lewyssmith
In VirtualBox, M6, Mate, 32-bit Package(s) under test: apache-commons-email apache-commons-email-javadoc default install of apache-commons-email & apache-commons-email-javadoc [root@localhost wilcal]# urpmi apache-commons-email Package apache-commons-email-1.3.1-10.mga6.noarch is already installed [root@localhost wilcal]# urpmi apache-commons-email-javadoc Package apache-commons-email-javadoc-1.3.1-10.mga6.noarch is already installed apache-commons-email installs without error install apache-commons-email & apache-commons-email-javadoc from updates_testing [root@localhost wilcal]# urpmi apache-commons-email Package apache-commons-email-1.3.1-10.1.mga6.noarch is already installed [root@localhost wilcal]# urpmi apache-commons-email-javadoc Package apache-commons-email-javadoc-1.3.1-10.1.mga6.noarch is already installed Packages install and update without error
CC: (none) => wilcal.intWhiteboard: MGA5TOO MGA5-32-OK advisory => MGA5TOO MGA5-32-OK MGA6-32-OK advisory
In VirtualBox, M6, Mate, 64-bit Package(s) under test: apache-commons-email apache-commons-email-javadoc default install of apache-commons-email & apache-commons-email-javadoc [root@localhost wilcal]# urpmi apache-commons-email Package apache-commons-email-1.3.1-10.mga6.noarch is already installed [root@localhost wilcal]# urpmi apache-commons-email-javadoc Package apache-commons-email-javadoc-1.3.1-10.mga6.noarch is already installed apache-commons-email installs without error install apache-commons-email & apache-commons-email-javadoc from updates_testing [root@localhost wilcal]# urpmi apache-commons-email Package apache-commons-email-1.3.1-10.1.mga6.noarch is already installed [root@localhost wilcal]# urpmi apache-commons-email-javadoc Package apache-commons-email-javadoc-1.3.1-10.1.mga6.noarch is already installed Packages install and update without error
Whiteboard: MGA5TOO MGA5-32-OK MGA6-32-OK advisory => MGA5TOO MGA5-32-OK MGA6-32-OK MGA6-64-OK advisory
In VirtualBox, M5.1, KDE, 64-bit Package(s) under test: apache-commons-email apache-commons-email-javadoc default install of apache-commons-email & apache-commons-email-javadoc [root@localhost wilcal]# urpmi apache-commons-email Package apache-commons-email-1.3.1-4.mga5.noarch is already installed [root@localhost wilcal]# urpmi apache-commons-email-javadoc Package apache-commons-email-javadoc-1.3.1-4.mga5.noarch is already installed apache-commons-email installs without error install apache-commons-email & apache-commons-email-javadoc from updates_testing [root@localhost wilcal]# urpmi apache-commons-email Package apache-commons-email-1.3.1-4.1.mga5.noarch is already installed [root@localhost wilcal]# urpmi apache-commons-email-javadoc Package apache-commons-email-javadoc-1.3.1-4.1.mga5.noarch is already installed Packages install and update without error
Whiteboard: MGA5TOO MGA5-32-OK MGA6-32-OK MGA6-64-OK advisory => MGA5TOO MGA5-32-OK MGA5-64-OK MGA6-32-OK MGA6-64-OK advisory
This update works fine. Testing complete for MGA5 & MGA6, 32-bit & 64-bit Validating the update. Could someone from the sysadmin team push to updates. Thanks
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0322.html
Status: NEW => RESOLVEDResolution: (none) => FIXED