Bug 25742 - signing-party new security issue CVE-2019-11627
Summary: signing-party new security issue CVE-2019-11627
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-11-25 17:45 CET by David Walser
Modified: 2019-11-30 20:20 CET (History)
2 users (show)

See Also:
Source RPM: signing-party-2.7-2.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-11-25 17:45:38 CET
openSUSE has issued an advisory on May 13:
https://lists.opensuse.org/opensuse-security-announce/2019-05/msg00029.html

The issue is fixed upstream in 2.10.
Comment 1 David GEIGER 2019-11-25 17:57:10 CET
Done!
Comment 2 David Walser 2019-11-25 19:28:11 CET
Advisory:
========================

Updated signing-party package fixes security vulnerability:

The gpg-key2ps tool in signing-party contained an unsafe shell call enabling
shell injection via a User ID (CVE-2019-11627).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11627
https://lists.opensuse.org/opensuse-updates/2019-05/msg00085.html
========================

Updated packages in core/updates_testing:
========================
signing-party-2.10-1.mga7

from signing-party-2.10-1.mga7.src.rpm

Assignee: geiger.david68210 => qa-bugs
CC: (none) => geiger.david68210

Comment 3 Herman Viaene 2019-11-30 20:20:03 CET
MGA7-64 Plasma on Lenovo B50
No istallation issues
No idea what  to test here. Googled and found https://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html#overview which is hardly encouraging me that there is a simple wat to test this.
Apparently installing this does not blow up anything else.

CC: (none) => herman.viaene


Note You need to log in before you can comment on or make changes to this bug.