Bug 24481 - hiawatha new security issue CVE-2019-8358
Summary: hiawatha new security issue CVE-2019-8358
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6-64-OK
Keywords: advisory, has_procedure, validated_update
Depends on:
Blocks:
 
Reported: 2019-03-08 22:16 CET by David Walser
Modified: 2019-03-14 22:41 CET (History)
6 users (show)

See Also:
Source RPM: hiawatha-10.8.1-3.mga7.src.rpm
CVE:
Status comment: Fixed upstream in 10.8.4

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2019-03-08 22:16:11 CET 
openSUSE has issued an advisory on March 6:
https://lists.opensuse.org/opensuse-updates/2019-03/msg00022.html

The issue is fixed upstream in 10.8.4.

Mageia 6 is also affected.
David Walser 2019-03-08 22:16:17 CET

Whiteboard: (none) => MGA6TOO

David Walser 2019-03-09 02:25:00 CET

CC: (none) => smelror

Comment 1 Marja Van Waes 2019-03-09 07:44:22 CET 
Assigning to all packagers collectively, since there is no registered maintainer for this package.

CC: (none) => marja11
Assignee: bugsquad => pkg-bugs

David Walser 2019-03-09 17:34:22 CET

Status comment: (none) => Fixed upstream in 10.8.4

Comment 2 Mike Rambo 2019-03-12 19:51:20 CET 
Updated package uploaded for cauldron and Mageia 6.

Advisory:
========================

Updated hiawatha package fixes security vulnerability:

Verison 10.8.4 fixed a vulnerability which allowed a remote atacker to
perform directory traversal when AllowDotFiles was enabled (CVE-2019-8358).


References:
https://lists.opensuse.org/opensuse-updates/2019-03/msg00022.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8358
========================

Updated packages in core/updates_testing:
========================
hiawatha-10.8.4-1.mga6

from hiawatha-10.8.4-1.mga6.src.rpm

Link to test procedure: https://bugs.mageia.org/show_bug.cgi?id=15391#c17

Keywords: (none) => has_procedure
CC: (none) => mrambo
Version: Cauldron => 6
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA6TOO => (none)

Comment 3 Len Lawrence 2019-03-12 23:58:13 CET 
mga6, x86_64

Updated hiawatha, stopped apache, enabled and started hiawatha.
$ systemctl status hiawatha
● hiawatha.service - Hiawatha Web Server
   Loaded: loaded (/usr/lib/systemd/system/hiawatha.service; enabled; vendor pre
   Active: active (running) since Tue 2019-03-12 22:31:57 GMT; 8s ago
  Process: 8550 ExecStartPre=/usr/sbin/hiawatha -k (code=exited, status=0/SUCCES
  Process: 8548 ExecStartPre=/usr/sbin/wigwam (code=exited, status=0/SUCCESS)
 Main PID: 8553 (hiawatha)
   CGroup: /system.slice/hiawatha.service
           └─8553 /usr/sbin/hiawatha -d

Pointed firefox at localhost and saw the welcome message:
Installation successful

Congratulations! The Hiawatha webserver has successfully been installed on this system. For more information about this webserver, visit the Hiawatha website.
[...]

Visited some familiar weblinks like exoplanet.eu and APOD.
Started a php server on port 8000 and successfully ran a sample php script at localhost:8000/

So far it looks fine.  Did not make  much headway with the tests referred to in comment 2 but shall have another look at them.

CC: (none) => tarazed25

Len Lawrence 2019-03-13 13:02:52 CET

Whiteboard: (none) => MGA6-64-OK

Dave Hodgins 2019-03-14 20:45:10 CET

Keywords: (none) => advisory, validated_update
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 4 Mageia Robot 2019-03-14 22:41:18 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0112.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.