Bug 25805 - lz4 new security issue CVE-2019-17543
Summary: lz4 new security issue CVE-2019-17543
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-12-03 19:02 CET by David Walser
Modified: 2019-12-08 19:13 CET (History)
4 users (show)

See Also:
Source RPM: lz4-1.8.3-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-12-03 19:02:06 CET
openSUSE has issued an advisory on October 29:
https://lists.opensuse.org/opensuse-updates/2019-10/msg00171.html

The issue is fixed upstream in 1.9.2.
Comment 1 David GEIGER 2019-12-04 07:41:34 CET
Done!
Comment 2 David Walser 2019-12-04 13:44:01 CET
Advisory:
========================

Updated lz4 packages fix security vulnerability:

Heap-based buffer overflow in LZ4_write32 (CVE-2019-17543).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17543
https://lists.opensuse.org/opensuse-updates/2019-10/msg00171.html
========================

Updated packages in core/updates_testing:
========================
liblz4-devel-1.9.2-1.mga7
liblz4-static-devel-1.9.2-1.mga7
liblz4_1-1.9.2-1.mga7

from lz4-1.9.2-1.mga7.src.rpm

Assignee: geiger.david68210 => qa-bugs
CC: (none) => geiger.david68210

Comment 3 PC LX 2019-12-08 17:35:19 CET
Installed and tested without issue.

Tests:
- creating a lz4 compressed fs using the mksquashfs command from the squashfs-tools;
- creating a database table compressed with lz4, in a innodb database, in a mariadb database server;

Note: The lz4 command in the lz4 package does not seem to use the lz4 library so I'm not including it in the tests.


System: Mageia 7, x86_64, Intel CPU.


$ uname -a
Linux marte 5.4.2-desktop-1.mga7 #1 SMP Thu Dec 5 17:40:00 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -qa | grep lz4
lib64lz4-devel-1.9.2-1.mga7
liblz4_1-1.9.2-1.mga7
lib64lz4_1-1.9.2-1.mga7
lz4-1.9.2-1.mga7
$ mksquashfs ~/tmp /tmp/test.squash -comp lz4
Parallel mksquashfs: Using 4 processors
Creating 4.0 filesystem on /tmp/test.squash, block size 131072.


Exportable Squashfs 4.0 filesystem, lz4 compressed, data block size 131072
        compressed data, compressed metadata, compressed fragments, compressed xattrs
        duplicates are removed
<SNIP>
$ grep liblz4 lz4.log 
openat(AT_FDCWD, "/lib64/liblz4.so.1", O_RDONLY|O_CLOEXEC) = 3

CC: (none) => mageia
Whiteboard: (none) => MGA7-64-OK

Thomas Backlund 2019-12-08 18:52:14 CET

CC: (none) => tmb, sysadmin-bugs
Keywords: (none) => advisory, validated_update

Comment 4 Mageia Robot 2019-12-08 19:13:28 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0375.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.