Bug 22864 - ntp new security issues CVE-2016-1549, CVE-2018-7170, CVE-2018-718[2-5], CVE-2018-12327
Summary: ntp new security issues CVE-2016-1549, CVE-2018-7170, CVE-2018-718[2-5], CVE-...
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: All Packagers
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on: 22850
Blocks:
  Show dependency tree / graph
 
Reported: 2018-04-02 12:53 CEST by David Walser
Modified: 2018-10-06 12:54 CEST (History)
4 users (show)

See Also:
Source RPM: ntp-4.2.6p5-24.8.mga5.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2018-04-02 12:53:30 CEST 
+++ This bug was initially created as a clone of Bug #22850 +++

Fedora has issued an advisory on March 27:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/PAWSWGYT4BYAU6JMQXZOD22NFWPCVJQP/

The issues are fixed upstream in 4.2.8p11.

We should also add the noepeer restriction to the default config if we haven't:
https://src.fedoraproject.org/cgit/rpms/ntp.git/commit/?h=f27&id=ddca0198432d804162e603e987237163b628c587
Comment 1 Marja Van Waes 2018-04-03 12:21:18 CEST 
Assigning to all packagers collectively, since there is no registered maintainer for this package.
CC'ing three committers.

CC: (none) => guichard.adrien, guillomovitch, lists.jjorge, marja11
Assignee: bugsquad => pkg-bugs

David Walser 2018-06-08 20:57:57 CEST

Summary: ntp new security issue CVE-2016-1549, CVE-2018-717[0,2-5] => ntp new security issue CVE-2016-1549, CVE-2018-7170, CVE-2018-718[2-5]

Comment 2 David Walser 2018-07-16 20:28:12 CEST 
Ubuntu has issued an advisory for the latter of these issues on July 9:
https://usn.ubuntu.com/3707-1/

We can borrow patches from Ubuntu 14.04.
Comment 3 Guillaume Rousse 2018-07-19 19:38:26 CEST 
Unless I'm mistaken, Mageia 5 is officialy EOLed:
https://blog.mageia.org/en/2017/11/07/mageia-5-eol-postponed/

So, why waste time providing update for it ?
Comment 4 David Walser 2018-07-20 13:07:41 CEST 
We're still providing limited support for it for a number of reasons, but you're under no obligation to help with that, so don't worry about it.  I'll take care of this when I have time.
Comment 5 David Walser 2018-08-31 19:10:13 CEST 
Fedora has issued an advisory on August 30:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/437XM4CMBCMPK7D2RSEUZIRLFZD5ZNRD/

It fixes one additional issue.

Summary: ntp new security issue CVE-2016-1549, CVE-2018-7170, CVE-2018-718[2-5] => ntp new security issues CVE-2016-1549, CVE-2018-7170, CVE-2018-718[2-5], CVE-2018-12327

Comment 6 Marja Van Waes 2018-10-06 12:54:12 CEST 
The limited support Mga5 continued to have after its official EOL has ended, so closing this bug as OLD.

Resolution: (none) => OLD
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.