Bug 25752 - python-twisted new security issues CVE-2019-12387 and CVE-2019-12855
Summary: python-twisted new security issues CVE-2019-12387 and CVE-2019-12855
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-11-26 16:29 CET by David Walser
Modified: 2019-12-06 15:17 CET (History)
5 users (show)

See Also:
Source RPM: python-twisted-19.2.0-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-11-26 16:29:08 CET
openSUSE has issued an advisory on July 21:
https://lists.opensuse.org/opensuse-updates/2019-07/msg00089.html

The issue is fixed upstream in 19.2.1.
Comment 1 David Walser 2019-11-26 18:11:09 CET
Updated package uploaded by Jani.

Advisory:
========================

Updated python-twisted packages fix security vulnerability:

Improper sanitization of URIs or HTTP which could allow attackers to perfrom
CRLF attacks (CVE-2019-12387).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12387
https://lists.opensuse.org/opensuse-updates/2019-07/msg00089.html
========================

Updated packages in core/updates_testing:
========================
python2-twisted-19.2.1-1.mga7
python3-twisted-19.2.1-1.mga7

from python-twisted-19.2.1-1.mga7.src.rpm

Assignee: jani.valimaa => qa-bugs
CC: (none) => jani.valimaa

Comment 2 David Walser 2019-11-26 22:26:34 CET
openSUSE has issued an advisory on September 5:
https://lists.opensuse.org/opensuse-updates/2019-09/msg00028.html

It looks like this new issue will need an additional patch.

Keywords: (none) => feedback
Summary: python-twisted new security issue CVE-2019-12387 => python-twisted new security issues CVE-2019-12387 and CVE-2019-12855

David Walser 2019-11-27 19:07:03 CET

Keywords: feedback => (none)
CC: jani.valimaa => qa-bugs
Assignee: qa-bugs => jani.valimaa

Comment 3 David Walser 2019-11-27 20:36:52 CET
Advisory:
========================

Updated python-twisted packages fix security vulnerability:

Improper sanitization of URIs or HTTP which could allow attackers to perform
CRLF attacks (CVE-2019-12387).

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did
not verify certificates when used with TLS, allowing an attacker to MITM
connections (CVE-2019-12855).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12387
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12855
https://lists.opensuse.org/opensuse-updates/2019-07/msg00089.html
https://lists.opensuse.org/opensuse-updates/2019-09/msg00028.html
========================

Updated packages in core/updates_testing:
========================
python2-twisted-19.2.1-1.1.mga7
python3-twisted-19.2.1-1.1.mga7

from python-twisted-19.2.1-1.1.mga7.src.rpm

CC: (none) => jani.valimaa
Assignee: jani.valimaa => qa-bugs

Comment 4 Herman Viaene 2019-11-29 16:56:12 CET
MGA7-64 Plasma on Lenovo B50
No installation issues.
At CLI:
# urpmq --whatrequires python3-twisted
kajongg
python3-prometheus-client
python3-twisted
took the easy one, installed kajongg and
$ strace -o pthtwusted.txt kajongg
shows a lot of references like

openat(AT_FDCWD, "/usr/lib64/python3.7/site-packages/twisted/__pycache__/__init__.cpython-37.pyc", O_RDONLY|O_CLOEXEC) = 10
and
stat("/usr/lib64/python3.7/site-packages/twisted", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
Looking further for a python2-twisted testcase.

CC: (none) => herman.viaene

Comment 5 Herman Viaene 2019-11-29 17:20:35 CET
# urpmq --whatrequires python2-twisted
avahi-python
balazarbrothers
buildbot-master
buildbot-slave
deluge
noethys
python-axiom
python-epsilon
python-foolscap
python-moksha-hub
python-storm-twisted
python-txws
python-txzmq
python2-twisted
sslstrip
supybot-Dcc
supybot-ExternalNotice
supybot-Gateway
supybot-Sshd
supybot-Webserver
syncevolution
taskcoach
tofu
Picked first tofu, had to install python2-cerealizer and could then run
$ strace -o pthtwusted2.txt python2 /usr/share/doc/tofu/run_demo.py --client localhost
* Tofu * IDLER created !
that opened a otherwise empty tofu window, but the trace shows calls to python2-twisted
Tried taskcoach
$ strace -o pthtwustedtaskcoach.txt taskcoach
I could create a new task,and play around in the gui-interface, trace shows again shows calls to python2-twisted
OK for me unless someone needs more tests.

Whiteboard: (none) => MGA7-64-OK

Thomas Backlund 2019-12-06 14:36:02 CET

Keywords: (none) => advisory, validated_update
CC: (none) => tmb, sysadmin-bugs

Comment 6 Mageia Robot 2019-12-06 15:17:19 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0360.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.