Bug 22792 - sqlite3 new security issue CVE-2018-8740
Summary: sqlite3 new security issue CVE-2018-8740
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA5-32-OK MGA6-32-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2018-03-17 17:12 CET by David Walser
Modified: 2018-03-22 23:40 CET (History)
4 users (show)

See Also:
Source RPM: sqlite3-3.17.0-2.1.mga6.src.rpm
CVE:
Status comment: Fix checked into SVN


Attachments

Description David Walser 2018-03-17 17:12:01 CET
A security issue fixed upstream in sqlite3 has been announced with a CVE:
http://openwall.com/lists/oss-security/2018/03/17/1

Patched package uploaded for Cauldron.

Patch checked into SVN for Mageia 6.

Mageia 5 is also affected, but the patch would need to be rediffed.
Comment 1 David Walser 2018-03-17 17:35:19 CET
I've also checked a rediffed patch for this in to Mageia 5 SVN for the firefox package, as it builds with the bundled sqlite3 (Mageia 6 uses the system sqlite3).

Status comment: (none) => Fix checked into SVN for mga6

Comment 2 Marja Van Waes 2018-03-17 17:36:19 CET
Assigning to the registered sqlite3 maintainer.

Assignee: bugsquad => shlomif
CC: (none) => marja11

Comment 3 David Walser 2018-03-17 17:45:37 CET
Patch checked into Mageia 5 SVN for sqlite3 as well.

Status comment: Fix checked into SVN for mga6 => Fix checked into SVN
Whiteboard: (none) => MGA5TOO

Comment 4 Shlomi Fish 2018-03-17 20:34:38 CET
After toggling bcond_without check in the .spec of 6/sqlite3 and building it the tests are failing with a compile error. Is it safe to proceed?
Comment 5 David Walser 2018-03-17 20:36:46 CET
(In reply to Shlomi Fish from comment #4)
> After toggling bcond_without check in the .spec of 6/sqlite3 and building it
> the tests are failing with a compile error. Is it safe to proceed?

Was this case before the patch was added?
Comment 6 David Walser 2018-03-17 22:43:41 CET
Shlomi confirmed on IRC that the test suite breakage happened before the addition of the patch for this issue.  He also pushed it to the build system.

Advisory:
========================

Updated sqlite3 packages fix security vulnerability:

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE
TABLE AS statement could cause a NULL pointer dereference, related to build.c
and prepare.c (CVE-2018-8740).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8740
http://openwall.com/lists/oss-security/2018/03/17/1
========================

Updated packages in core/updates_testing:
========================
libsqlite3_0-3.10.2-1.2.mga5
libsqlite3-devel-3.10.2-1.2.mga5
libsqlite3-static-devel-3.10.2-1.2.mga5
sqlite3-tools-3.10.2-1.2.mga5
lemon-3.10.2-1.2.mga5
sqlite3-tcl-3.10.2-1.2.mga5
libsqlite3_0-3.17.0-2.2.mga6
libsqlite3-devel-3.17.0-2.2.mga6
libsqlite3-static-devel-3.17.0-2.2.mga6
sqlite3-tools-3.17.0-2.2.mga6
lemon-3.17.0-2.2.mga6
sqlite3-tcl-3.17.0-2.2.mga6

from SRPMS:
sqlite3-3.10.2-1.2.mga5.src.rpm
sqlite3-3.17.0-2.2.mga6.src.rpm

Assignee: shlomif => qa-bugs
CC: (none) => shlomif

Comment 7 Herman Viaene 2018-03-20 14:31:14 CET
MGA5-32 on Dell Latitude D600
No installation issues
Testing as per bug 21200 Comment 9, getting same results. Also tested .help function, all OK.

Whiteboard: MGA5TOO => MGA5TOO MGA5-32-OK
CC: (none) => herman.viaene

Comment 8 Herman Viaene 2018-03-22 12:17:47 CET
MGA6-32 on Dell Latitude D600
No installation issues.
Confirm same results as above Comment 7.
Herman Viaene 2018-03-22 12:18:45 CET

Whiteboard: MGA5TOO MGA5-32-OK => MGA5TOO MGA5-32-OK MGA6-32-OK

Comment 9 Lewis Smith 2018-03-22 19:57:48 CET
Many thanks Herman for both release tests. Validating, advisoried.
The CVE leads to a PoC:
 https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1756349
but it uses a test database 'gdal_ossfuzz_6964.db'  which I could not find; and valgrind.

Keywords: (none) => advisory, validated_update
CC: (none) => sysadmin-bugs

Comment 10 Mageia Robot 2018-03-22 23:40:10 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0181.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.