Bug 25112 - libosinfo new security issue CVE-2019-13313
Summary: libosinfo new security issue CVE-2019-13313
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-07-12 00:55 CEST by David Walser
Modified: 2021-07-10 14:58 CEST (History)
4 users (show)

See Also:
Source RPM: libosinfo-1.4.0-2.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-07-12 00:55:56 CEST
A security issue in libosinfo has been announced on July 8:
https://www.openwall.com/lists/oss-security/2019/07/08/3
https://bugzilla.redhat.com/show_bug.cgi?id=1727766

I'm not sure how far back it's affected, but the package does also exist in Mageia 6.  There's already a fix in Cauldron.
Comment 1 David Walser 2019-11-12 17:59:33 CET
RedHat has issued an advisory for this on November 5:
https://access.redhat.com/errata/RHSA-2019:3387
Comment 2 David Walser 2019-12-05 00:20:57 CET
SUSE has issued an advisory for this on September 3:
http://lists.suse.com/pipermail/sle-security-updates/2019-September/005876.html
Comment 3 David Walser 2020-03-31 20:53:44 CEST
RedHat has issued an advisory for this today (March 31):
https://access.redhat.com/errata/RHSA-2020:1051

So that's libosinfo 1.1.0 and 1.5.0 they've patched and we have 1.4.0.
Comment 4 Nicolas Lécureuil 2020-05-28 00:33:32 CEST
updated to version 1.5.0


libosinfo-1.5.0-1.mga7

Assignee: thierry.vignaud => qa-bugs
CC: (none) => mageia

Comment 5 David Walser 2020-05-28 01:32:59 CEST
1.5.0 doesn't fix the issue.  You can see RedHat's patches here:
https://git.centos.org/rpms/libosinfo/tree/c8

Assignee: qa-bugs => mageia
CC: (none) => qa-bugs

Comment 6 Nicolas Lécureuil 2020-05-28 02:16:28 CEST
i know :)  but 0008-CVE-2019-13313.patch is on the rpm ;)

Assignee: mageia => qa-bugs

Comment 7 David Walser 2020-05-28 03:18:28 CEST
Ahh, silently added in December.  It corresponds to RedHat's last two patches.  We should at least add their first two (null dereference and accessing freed memory) if not the first three.

CC: qa-bugs => (none)

Comment 8 Herman Viaene 2020-05-29 15:15:05 CEST
When I try to install I get:Sorry, the following package cannot be selected:

- libosinfo-1.5.0-1.mga7.x86_64 (due to unsatisfied libosinfo-1.0.so.0(LIBOSINFO_1.5.0)(64bit))

CC: (none) => herman.viaene

David Walser 2020-05-30 22:08:55 CEST

Assignee: qa-bugs => mageia
CC: (none) => qa-bugs

Comment 9 Nicolas Lécureuil 2021-03-09 22:47:26 CET
rebuild + install locally OK 


src:
    - libosinfo-1.5.0-1.mga7

Assignee: mageia => qa-bugs

Comment 10 David Walser 2021-03-10 00:44:05 CET
(In reply to David Walser from comment #7)
> Ahh, silently added in December.  It corresponds to RedHat's last two
> patches.  We should at least add their first two (null dereference and
> accessing freed memory) if not the first three.

How about this?

Assignee: qa-bugs => mageia

Comment 11 Nicolas Lécureuil 2021-03-10 07:43:58 CET
i see that distributions like fedora have updated stable to at least 1.7.1.

Maybe we can do as the major is the same ( no rebuild needed ).

I propose to update like in mga8 to 1.9.0
Comment 12 David Walser 2021-06-29 01:28:22 CEST
Updated to 1.8.0:
libosinfo-1.8.0-1.mga7
libosinfo1.0_0-1.8.0-1.mga7
libosinfo1.0-devel-1.8.0-1.mga7
libosinfo-vala-1.8.0-1.mga7
libosinfo-gir1.0-1.8.0-1.mga7

from libosinfo-1.8.0-1.mga7.src.rpm

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13313
https://access.redhat.com/errata/RHSA-2019:3387
https://access.redhat.com/errata/RHBA-2020:4758

Assignee: mageia => qa-bugs
CC: qa-bugs => (none)

Comment 13 David Walser 2021-07-01 00:23:10 CEST
Advisory:
========================

Updated libosinfo packages fix security vulnerability:

A flaw was found in libosinfo, version 1.5.0, where the script for automated
guest installations, 'osinfo-install-script', accepts user and admin passwords
via command line arguments. This could allow guest passwords to leak to other
system users via a process listing (CVE-2019-13313).

The libosinfo package has been updated to version 1.8.0, fixing this issue and
other bugs.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13313
https://access.redhat.com/errata/RHSA-2019:3387
https://access.redhat.com/errata/RHBA-2020:4758
Comment 14 Herman Viaene 2021-07-08 14:30:45 CEST
MGA7-64 Plasma on Lenovo B50
No installation issues.
At CLI
# osinfo-detect 
Usage:
  osinfo-detect [OPTION…] - Detect if media is bootable and the relevant OS and distribution.

Help Options:
  -h, --help                 Show help options

Application Options:
  -f, --format=plain.        Output format. Default: plain
  -t, --type=media|tree.     The type to be used. Default: media

I cann't get my head around with this all is for or really means. If the higher powers esteem thsi can be released on clean install, then go ahead.
Comment 15 David Walser 2021-07-08 14:38:04 CEST
Best test is to try something that uses this library, like gnome-boxes or tracker-miners.  Testing binaries shipped with a library is usually not a valid test.
Comment 16 David Walser 2021-07-08 14:39:13 CEST
When the library has been upgraded, I mean.  If it's just patched then that's also valid.
Comment 17 Herman Viaene 2021-07-08 15:29:31 CEST
Hmmmm, tracker-miners seems to be a set of 4 services, not sure what to expect.
installed gnome-boxes which draws in 92 other packages, and then when I launch it, it gives: Oops, something went wrong, gnome-boxes cannot access the virtualization background.
I give up.
Comment 18 David Walser 2021-07-08 16:17:47 CEST
Oops indeed!  Maybe try virt-v2v, which says it can convert between different VM types.
Comment 19 David Walser 2021-07-08 16:18:49 CEST
And if you can't get that to work, then yes just pass it on a clean upgrade.  It should be fine.
Comment 20 Herman Viaene 2021-07-09 10:35:36 CEST
I don't have virtual machines on this laptop, too meager for that, so clean install it is.

Whiteboard: (none) => MGA7-64-OK

Comment 21 Thomas Andrews 2021-07-09 16:03:26 CEST
A valiant effort, Herman. Validating. Advisory in Comment 13.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2021-07-10 13:11:27 CEST

Keywords: (none) => advisory

Comment 22 Mageia Robot 2021-07-10 14:58:24 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0325.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.