A security issue fixed upstream in backintime has been given a CVE: http://openwall.com/lists/oss-security/2017/11/08/9 The message above contains a link to the commit that fixed the issue. The issue is fixed in 1.1.24, which David already updated Cauldron to: https://github.com/bit-team/backintime/releases/tag/v1.1.24 Mageia 5 is also likely to be affected.
Whiteboard: (none) => MGA5TOO
Built so far by David: backintime-common-1.1.24-1.mga6 backintime-qt4-1.1.24-1.mga6 from backintime-1.1.24-1.mga6.src.rpm
Fedora has issued an advisory for this on November 19: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4QNBPN76RX2RKR2K7NEMJMOD576ASBHA/
openSUSE has issued an advisory for this today (November 26): https://lists.opensuse.org/opensuse-updates/2017-11/msg00078.html
Not sure what happened to David, but obviously he doesn't intend to update this for Mageia 5. Assigning Mageia 6 update to QA. Advisory: ======================== Updated backintime packages fix security vulnerability: backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands (CVE-2017-16667). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16667 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4QNBPN76RX2RKR2K7NEMJMOD576ASBHA/ ======================== Updated packages in core/updates_testing: ======================== backintime-common-1.1.24-1.mga6 backintime-qt4-1.1.24-1.mga6 from backintime-1.1.24-1.mga6.src.rpm
Assignee: geiger.david68210 => qa-bugsWhiteboard: MGA5TOO => (none)
The following 78 packages are going to be installed: - appres-1.0.4-5.mga6.x86_64 - backintime-common-1.1.24-1.mga6.noarch - backintime-qt4-1.1.24-1.mga6.noarch - editres-1.0.6-5.mga6.x86_64 - encfs-1.8.1-6.mga6.x86_64 - lbxproxy-1.0.3-5.mga6.x86_64 - lib64boost_serialization1.60.0-1.60.0-6.mga6.x86_64 - lib64encfs6-1.8.1-6.mga6.x86_64 - lib64fs6-1.0.7-2.mga6.x86_64 - lib64lbxutil1-1.1.0-8.mga6.x86_64 - lib64proj9-4.9.2-1.mga6.x86_64 - lib64qtdeclarative4-4.8.7-15.mga6.x86_64 - lib64qtdesigner4-4.8.7-15.mga6.x86_64 - lib64qtlocation1-1.2.2-4.mga6.x86_64 - lib64qtmultimedia4-4.8.7-15.mga6.x86_64 - lib64qtsensors1-1.2.2-4.mga6.x86_64 - lib64qttest4-4.8.7-15.mga6.x86_64 - lib64qtwebkit2.2_4-2.3.4-9.mga6.x86_64 - lib64qtxmlpatterns4-4.8.7-15.mga6.x86_64 - lib64rlog5-1.4-9.mga6.x86_64 - lib64xtrap6-1.0.1-7.mga6.x86_64 - libnotify-0.7.7-1.mga6.x86_64 - listres-1.0.3-6.mga6.x86_64 - luit-1.1.1-8.mga6.x86_64 - makedepend-1.0.5-5.mga6.x86_64 - proxymngr-1.0.3-5.mga6.x86_64 - python-qt4-core-4.11.4-10.mga6.x86_64 - python-sip-4.18.1-1.mga6.x86_64 - python3-keyring-8.5.1-1.mga6.noarch - python3-qt4-4.11.4-10.mga6.x86_64 - python3-qt4-core-4.11.4-10.mga6.x86_64 - python3-qt4-dbus-4.11.4-10.mga6.x86_64 - python3-qt4-declarative-4.11.4-10.mga6.x86_64 - python3-qt4-designer-4.11.4-10.mga6.x86_64 - python3-qt4-gui-4.11.4-10.mga6.x86_64 - python3-qt4-multimedia-4.11.4-10.mga6.x86_64 - python3-qt4-network-4.11.4-10.mga6.x86_64 - python3-qt4-opengl-4.11.4-10.mga6.x86_64 - python3-qt4-script-4.11.4-10.mga6.x86_64 - python3-qt4-sql-4.11.4-10.mga6.x86_64 - python3-qt4-svg-4.11.4-10.mga6.x86_64 - python3-qt4-test-4.11.4-10.mga6.x86_64 - python3-qt4-webkit-4.11.4-10.mga6.x86_64 - python3-qt4-xml-4.11.4-10.mga6.x86_64 - python3-qt4-xmlpatterns-4.11.4-10.mga6.x86_64 - python3-sip-4.18.1-1.mga6.x86_64 - qt4-xmlpatterns-4.8.7-15.mga6.x86_64 - qtwebkit-qmlplugin-2.3.4-9.mga6.x86_64 - rstart-1.0.5-5.mga6.x86_64 - smproxy-1.0.5-6.mga6.x86_64 - sshfs-fuse-2.5-4.mga6.x86_64 - viewres-1.0.4-5.mga6.x86_64 - x11-scripts-1.0.1-15.mga6.noarch - x11-tools-1.0.0-14.mga6.noarch - x11perf-1.5.4-6.mga6.x86_64 - xcmsdb-1.0.5-1.mga6.x86_64 - xconsole-1.0.7-1.mga6.x86_64 - xcursorgen-1.0.6-5.mga6.x86_64 - xev-1.2.2-2.mga6.x86_64 - xfindproxy-1.0.3-5.mga6.x86_64 - xfsinfo-1.0.5-1.mga6.x86_64 - xfwp-1.0.3-5.mga6.x86_64 - xgamma-1.0.6-2.mga6.x86_64 - xkbevd-1.1.4-1.mga6.x86_64 - xkbprint-1.0.4-2.mga6.x86_64 - xkbutils-1.0.4-5.mga6.x86_64 - xkill-1.0.4-6.mga6.x86_64 - xlsatoms-1.1.1-6.mga6.x86_64 - xlsclients-1.1.3-5.mga6.x86_64 - xrefresh-1.0.5-5.mga6.x86_64 - xrx-1.0.4-6.mga6.x86_64 - xsetmode-1.0.0-14.mga6.x86_64 - xsetpointer-1.0.1-11.mga6.x86_64 - xstdcmap-1.0.3-5.mga6.x86_64 - xtrap-1.0.2-11.mga6.x86_64 - xvidtune-1.0.3-5.mga6.x86_64 - xvinfo-1.1.3-2.mga6.x86_64 - xwininfo-1.1.3-6.mga6.x86_64 86MB of additional disk space will be used. 22MB of packages will be retrieved. Is it ok to continue? --- $ uname -a Linux localhost 4.14.9-desktop-1.mga6 #1 SMP Mon Dec 25 15:27:17 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux ----- Ran backintime (back to Marty Fly) Was able to perform a backup to a USB drive. Did not try the network options. Working as designed.
Whiteboard: (none) => mga6-64-okCC: (none) => brtians1
Severity: normal => critical
]$ uname -a Linux localhost 4.9.56-desktop-1.mga6 #1 SMP Thu Oct 12 22:53:48 UTC 2017 i686 i686 i686 GNU/Linux The following 84 packages are going to be installed: - appres-1.0.4-5.mga6.i586 - backintime-common-1.1.24-1.mga6.noarch - backintime-qt4-1.1.24-1.mga6.noarch - dkms-nvidia304-304.137-2.mga6.nonfree.i586 - editres-1.0.6-5.mga6.i586 - encfs-1.8.1-6.mga6.i586 - lbxproxy-1.0.3-5.mga6.i586 - libboost_serialization1.60.0-1.60.0-6.mga6.i586 - libencfs6-1.8.1-6.mga6.i586 - libfs6-1.0.7-2.mga6.i586 - liblbxutil1-1.1.0-8.mga6.i586 - libproj9-4.9.2-1.mga6.i586 - libqtdbus4-4.8.7-15.mga6.i586 - libqtdeclarative4-4.8.7-15.mga6.i586 - libqtdesigner4-4.8.7-15.mga6.i586 - libqtlocation1-1.2.2-4.mga6.i586 - libqtmultimedia4-4.8.7-15.mga6.i586 - libqtnetwork4-4.8.7-15.mga6.i586 - libqtscript4-4.8.7-15.mga6.i586 - libqtsensors1-1.2.2-4.mga6.i586 - libqtsql4-4.8.7-15.mga6.i586 - libqttest4-4.8.7-15.mga6.i586 - libqtwebkit2.2_4-2.3.4-9.mga6.i586 - libqtxmlpatterns4-4.8.7-15.mga6.i586 - librlog5-1.4-9.mga6.i586 - libxtrap6-1.0.1-7.mga6.i586 - listres-1.0.3-6.mga6.i586 - makedepend-1.0.5-5.mga6.i586 - nvidia304-doc-html-304.137-2.mga6.nonfree.i586 - proxymngr-1.0.3-5.mga6.i586 - python-qt4-core-4.11.4-10.mga6.i586 - python-sip-4.18.1-1.mga6.i586 - python3-keyring-8.5.1-1.mga6.noarch - python3-qt4-4.11.4-10.mga6.i586 - python3-qt4-core-4.11.4-10.mga6.i586 - python3-qt4-dbus-4.11.4-10.mga6.i586 - python3-qt4-declarative-4.11.4-10.mga6.i586 - python3-qt4-designer-4.11.4-10.mga6.i586 - python3-qt4-gui-4.11.4-10.mga6.i586 - python3-qt4-multimedia-4.11.4-10.mga6.i586 - python3-qt4-network-4.11.4-10.mga6.i586 - python3-qt4-opengl-4.11.4-10.mga6.i586 - python3-qt4-script-4.11.4-10.mga6.i586 - python3-qt4-sql-4.11.4-10.mga6.i586 - python3-qt4-svg-4.11.4-10.mga6.i586 - python3-qt4-test-4.11.4-10.mga6.i586 - python3-qt4-webkit-4.11.4-10.mga6.i586 - python3-qt4-xml-4.11.4-10.mga6.i586 - python3-qt4-xmlpatterns-4.11.4-10.mga6.i586 - python3-sip-4.18.1-1.mga6.i586 - qt4-xmlpatterns-4.8.7-15.mga6.i586 - qtwebkit-qmlplugin-2.3.4-9.mga6.i586 - rstart-1.0.5-5.mga6.i586 - smproxy-1.0.5-6.mga6.i586 - sshfs-fuse-2.5-4.mga6.i586 - viewres-1.0.4-5.mga6.i586 - x11-driver-video-nvidia304-304.137-2.mga6.nonfree.i586 - x11-scripts-1.0.1-15.mga6.noarch - x11-tools-1.0.0-14.mga6.noarch - x11perf-1.5.4-6.mga6.i586 - xcmsdb-1.0.5-1.mga6.i586 - xconsole-1.0.7-1.mga6.i586 - xcursorgen-1.0.6-5.mga6.i586 - xev-1.2.2-2.mga6.i586 - xfindproxy-1.0.3-5.mga6.i586 - xfsinfo-1.0.5-1.mga6.i586 - xfwp-1.0.3-5.mga6.i586 - xgamma-1.0.6-2.mga6.i586 - xkbevd-1.1.4-1.mga6.i586 - xkbprint-1.0.4-2.mga6.i586 - xkbutils-1.0.4-5.mga6.i586 - xkill-1.0.4-6.mga6.i586 - xlsatoms-1.1.1-6.mga6.i586 - xlsclients-1.1.3-5.mga6.i586 - xrandr-1.5.0-1.mga6.i586 - xrefresh-1.0.5-5.mga6.i586 - xrx-1.0.4-6.mga6.i586 - xsetmode-1.0.0-14.mga6.i586 - xsetpointer-1.0.1-11.mga6.i586 - xstdcmap-1.0.3-5.mga6.i586 - xtrap-1.0.2-11.mga6.i586 - xvidtune-1.0.3-5.mga6.i586 - xvinfo-1.1.3-2.mga6.i586 - xwininfo-1.1.3-6.mga6.i586 151MB of additional disk space will be used. 37MB of packages will be retrieved. Is it ok to continue? Configured backintime. Ran backup on different files Working as designed.
Whiteboard: mga6-64-ok => mga6-64-ok mga6-32-ok
Thank you Brian for both your tests. Advisoried; validating.
Keywords: (none) => advisory, validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0059.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED