Bug 23174 - plexus-archiver new security issue CVE-2018-1002200
Summary: plexus-archiver new security issue CVE-2018-1002200
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2018-06-12 22:24 CEST by David Walser
Modified: 2019-01-05 19:31 CET (History)
4 users (show)

See Also:
Source RPM: plexus-archiver-3.4-1.mga6.src.rpm
CVE:
Status comment: Patch available from Fedora


Attachments

Description David Walser 2018-06-12 22:24:39 CEST
RedHat has issued an advisory today (June 12):
https://access.redhat.com/errata/RHSA-2018:1836

The issue is fixed upstream in 3.6.0.

Mageia 5 and Mageia 6 are also affected.
David Walser 2018-06-12 22:25:00 CEST

Whiteboard: (none) => MGA6TOO

Comment 2 David Walser 2019-01-01 04:52:25 CET
Fixed in plexus-archiver-3.5-2.mga7 in Cauldron.

Whiteboard: MGA6TOO => (none)
Version: Cauldron => 6

Comment 3 David Walser 2019-01-01 21:07:13 CET
Advisory:
========================

Updated plexus-archiver packages fix security vulnerability:

A path traversal vulnerability has been discovered in plexus-archiver when
extracting a carefully crafted zip file which holds path traversal file names.
A remote attacker could use this vulnerability to write files outside the
target directory and overwrite existing files with malicious code or vulnerable
configurations (CVE-2018-1002200).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1002200
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/I7XAAUCTHL2PDJHW5Q2IYATOAXX4AFFU/
========================

Updated packages in core/updates_testing:
========================
plexus-archiver-3.4-1.1.mga6
plexus-archiver-javadoc-3.4-1.1.mga6

from plexus-archiver-3.4-1.1.mga6.src.rpm

Assignee: java => qa-bugs

Comment 4 Len Lawrence 2019-01-02 18:20:18 CET
Mageia 6, x86_64

Could find no man pages or system menu entry for plexus-archiver.
API documentation at file:///usr/share/javadoc/plexus-archiver/help-doc.html

Information on the Zip Slip vulnerability at https://github.com/snyk/zip-slip-vulnerability

Before update:

urpmq --whatrequires-recursive turned up some applications needing plexus-archiver.
Installed curator along with 106 other packages including several plexus modules.  No man page or entry in the menus.  More java stuff by the looks of it.
Stumbled around looking for some way to use curator.
Tried this against local qa directory:
$ jar c /usr/share/java/curator/curator-client.jar qa > qa.plexus
qa/.#report.plexus : no such file or directory
qa/perl-Archive-Tar/moo : no such file or directory
qa/gd/demos : no such file or directory
qa/ruby/.#report.22844 : no such file or directory
qa/libc.so.6 : no such file or directory
qa/glibc/libc.so.6 : no such file or directory
qa/zend/Zend/library/Zend : no such file or directory

Not all of those messages make sense but something is being built, 2 gigabytes so far.
$ ll qa.plexus
-rw-r--r-- 1 lcl lcl 2115689925 Jan  2 17:10 qa.plexus
$ du -hs qa
6.0G	qa
Final count:
$ ll qa.plexus
-rw-r--r-- 1 lcl lcl 4045550189 Jan  2 17:17 qa.plexus
$ file qa.plexus
qa.plexus: Java archive data (JAR)

Shall try to read the "archive" after updating.

CC: (none) => tarazed25

Comment 5 Len Lawrence 2019-01-02 19:03:00 CET
Updated the packages and tried
$ jar tf qa.plexus | wc -l
20117
$ jar tf qa.plexus | head
META-INF/
META-INF/MANIFEST.MF
usr/share/java/curator/curator-client.jar
qa/
qa/LOtest.ps
qa/mgaonline/
qa/mgaonline/applet
qa/crypt/
qa/openjfx/
qa/openjfx/report.23349

That shows that the original command entirely missed the point, so I am giving up on this.
Comment 6 Len Lawrence 2019-01-02 19:42:57 CET
$ java -jar /usr/share/java/curator/curator-client.jar
no main manifest attribute, in /usr/share/java/curator/curator-client.jar
Comment 7 David Walser 2019-01-02 20:04:32 CET
Just a clean update will do.
Comment 8 Len Lawrence 2019-01-03 01:50:59 CET
OK - you've got it.

Whiteboard: (none) => MGA6-64-OK

Comment 9 Thomas Andrews 2019-01-03 18:58:32 CET
Well then, the only thing left to do is to validate. I can handle that.

Advisory in Comment 3.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Lewis Smith 2019-01-03 20:53:56 CET

Keywords: (none) => advisory
CC: (none) => lewyssmith

Comment 10 Mageia Robot 2019-01-05 19:31:43 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0005.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.