A vulnerability in the HTML_QuickForm package has been found which potentially allows remote code execution.
Assignee: php => mageia
Updated php-pear-HTML_QuickForm packages fix security vulnerabilities: A vulnerability in the HTML_QuickForm package has been found which potentially allows remote code execution. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1999022 ======================== Updated packages in core/updates_testing: ======================== php-pear-HTML_QuickForm-3.2.15-1.mga6.noarch.rpm Source RPMs: php-pear-HTML_QuickForm-3.2.15-1.mga6.src.rpm
Component: RPM Packages => SecurityCVE: (none) => CVE-2018-1999022QA Contact: (none) => securityAssignee: mageia => qa-bugs
Summary: Security issue injection issue => php-pear-HTML_QuickForm new security issue (eval injection) CVE-2018-1999022
MGA6-32 MATE on IBM Thinkpad R50e At installation selecting this package draws in 20+ php7 packages, but after agreeing on this I still get: Sorry, het volgende pakket is niet selecteerbaar: (package cannot be selected) - php-pear-HTML_QuickForm-3.2.15-1.mga6.noarch (vanwege onvoldane pear(HTML/QuickForm/utils.php)) unfulfilled pear(HTML/QuickForm/utils.php
CC: (none) => herman.viaene
thanks Herman, you're right. Pushed new release.
Testing M6/64 BEFORE update, installing the package added a couple of others: php-pear-HTML_Common 1.2.5 8.mga6 noarch * php-pear-HTML_QuickForm 3.2.14 5.mga6 noarch * php-pear-HTML_Template_IT 1.3.0 8.mga6 noarch No useful info from the CVE. No previous update for this pkg. This looks good: https://pear.php.net/manual/en/package.html.html-quickform.tutorial.php Running the script: $ php ./pearHTML.php outputs to STDOUT a chunk of HTML which will need wrapping in outer HTML to try in a browser. No time now.
CC: (none) => lewyssmith
Testing M6/64 BEFORE update: php-pear-HTML_QuickForm-3.2.14-5.mga6 Ran the script $ php ./pearHTML.php > pre1.htm and saved that O/P for reference. Edited this (to a *different* file) to enclose the whole in <HTML>...</HTML>, the script part in <HEAD>...</HEAD> and the HTML part in <BODY>...</BODY>. Opening that file in a browser showed a correct form, submitting a blank name field popped an error, it works. But this is more for interest. DURING update, I got the error: "Yn anffodus, nid oes modd dewis y pecyn canlynol: - php-pear-HTML_QuickForm-3.2.15-2.mga6.noarch (pear(HTML/QuickForm/Renderer/ITDynamic.php) heb ei foddloni)" = Cannot select pkg 'php-pear-HTML_QuickForm-3.2.15-2.mga6.noarch' because 'pear(HTML/QuickForm/Renderer/ITDynamic.php' cannot be satisfied. Before: $ urpmq --requires php-pear-HTML_QuickForm | grep ITDynamic $ After: $ urpmq --media 'updates testing' --requires php-pear-HTML_QuickForm | grep ITDynamic php-pear-HTML_QuickForm: pear(HTML/QuickForm/Renderer/ITDynamic.php) $ which shows that the update requires the new thingy, not required by its predecessor. ----------- $ php -v PHP 5.6.40 (cli) (built: Jan 11 2019 09:50:49)
Keywords: (none) => feedback
Created attachment 10683 [details] Script to use php-pear-HTML_QuickForm To use the script (e.g. from its own directory): $ php ./pearHTML.php > <output file> The O/P file is JavaScript + HTML. Keep it for reference re updates. Suggest editing this to a *different* file as a complete HTML page: enclose the whole in <HTML>...</HTML>, the script part in <HEAD>...</HEAD> and the HTML part in <BODY>...</BODY>. Open that file in a browser, it should show a valid form.
my apologies, the new package reuquires things it provides itself. I have to recheck, why this happens - it should not! it is one of those automagic things :(
strange - I've checked cauldron package which is identical, here the automagic discovered different things. Using the provides from cauldron, this package is installable now, with subrelease 3.
Keywords: feedback => (none)
Re-trying M6/64 See comment 5 for previous attempt. Before trying the update, I tested it empirically: $ urpmq --media 'updates testing' --requires php-pear-HTML_QuickForm | grep ITDynamic php-pear-HTML_QuickForm: pear(HTML/QuickForm/Renderer/ITDynamic.php) php-pear-HTML_QuickForm: pear(HTML/QuickForm/Renderer/ITDynamic.php) Do not know what to make of that, but the pkg could be selected & updated: - php-pear-HTML_QuickForm-3.2.15-3.mga6.noarch AFTER update $ php ./pearHTML.php > post1.htm PHP Warning: require_once(HTML/QuickForm.php): failed to open stream: No such file or directory in /home/lewis/tmp/pearHTML.php on line 3 PHP Fatal error: require_once(): Failed opening required 'HTML/QuickForm.php' (include_path='.:/usr/lib64/php/:/usr/share/pear/:/usr/share/php/') in /home/lewis/tmp/pearHTML.php on line 3 Remember this worked before. $ head pearHTML.php <?php // Load the main class require_once 'HTML/QuickForm.php'; Await a comment from Marc. @Herman: do you want to try again?
this one is a beast. There was a silent fail switch added, so I didn't see the error. Released subrel 4
(In reply to Marc Krämer from comment #10) > this one is a beast. And has been from the beginning. You can cheer up now! Tested OK M6/64 I first reverted to the version in the field: # urpmi --downgrade php-pear-HTML_QuickForm and re-ran this check: $ urpmq --media 'updates testing' --requires php-pear-HTML_QuickForm | grep ITDynamic php-pear-HTML_QuickForm: pear(HTML/QuickForm/Renderer/ITDynamic.php) which shows that entity as now being required (not a package, I think: I did not have anything like it, nor was it pulled in during the update). BEFORE update: php-pear-HTML_QuickForm-3.2.14-5.mga6 Having preserved the O/P files from c5 test, no need to rerun that. AFTER trouble-free update: php-pear-HTML_QuickForm-3.2.15-4.mga6 $ php ./pearHTML.php > post1.htm $ [So that now works again] $ cmp pre1.htm post1.htm $ [So the test O/Ps are identical]. And copying/editing this O/P into bare HTML wrappers as per c6, in a browser file:///home/lewis/tmp/post.htm again showed the correct form page. The update looks good. Advisory from comment 1, but version 3.2.15-4.mga6
Keywords: (none) => advisory, validated_updateWhiteboard: (none) => MGA6-64-OKCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2019-0049.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED