Bug 25865 - libssh new security issue CVE-2019-14889
Summary: libssh new security issue CVE-2019-14889
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
: 25905 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-12-12 23:48 CET by David Walser
Modified: 2019-12-20 21:27 CET (History)
6 users (show)

See Also:
Source RPM: libssh-0.9.2-1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-12-12 23:48:05 CET
SUSE has issued an advisory on December 11:
http://lists.suse.com/pipermail/sle-security-updates/2019-December/006238.html

The issue is fixed upstream in 0.8.8 and 0.9.3:
https://www.libssh.org/2019/12/10/libssh-0-9-3-and-libssh-0-8-8-security-release/

Mageia 7 is also affected.
David Walser 2019-12-12 23:48:32 CET

Whiteboard: (none) => MGA7TOO

Comment 1 David GEIGER 2019-12-13 01:24:56 CET
Done for both Cauldron and mga7!

CC: (none) => geiger.david68210

Comment 2 David Walser 2019-12-13 01:35:29 CET
Advisory:
========================

Updated libssh packages fix security vulnerability:

In an environment where a user is only allowed to copy files and not to execute
applications, it would be possible to pass a location which contains commands
to be executed in addition (CVE-2019-14889).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14889
https://www.libssh.org/security/advisories/CVE-2019-14889.txt
========================

Updated packages in core/updates_testing:
========================
libssh4-0.8.8-1.mga7
libssh-devel-0.8.8-1.mga7

from libssh-0.8.8-1.mga7.src.rpm

Whiteboard: MGA7TOO => (none)
Assignee: bugsquad => qa-bugs
Version: Cauldron => 7

Comment 3 David Walser 2019-12-14 18:46:04 CET
Ubuntu has issued an advisory for this on December 10:
https://usn.ubuntu.com/4219-1/

Severity: normal => major

Comment 4 Herman Viaene 2019-12-17 13:46:40 CET
MGA7-64 Plasma on Lenovo B50
At installation:
The following Packages have tobe removed for others to be upgraded:
curl-examples-7.66.0-1.mga7.noarch
 (vanwege onvoldane curl-devel >= 1:7.66.0-1.mga7)
lib64curl-devel-7.66.0-1.mga7.x86_64
 (vanwege ontbrekende devel(libssh(64bit)))
lib64ssh-devel-0.8.7-1.mga7.x86_64
 (vanwege onvoldane lib64ssh4 == 1:0.8.7-1.mga7)
Answer yes and then when applying:
devel(libcurl(64bit)) is needed by (geïnstalleerd) lib64netcdf-devel-4.6.1-5.mga7.x86_64

CC: (none) => herman.viaene

Comment 5 David Walser 2019-12-17 13:50:54 CET
You should really run it in English if you're going to paste error messages, but it sounds to me like you asked it to only update lib64ssh4 and not lib64ssh-devel while you have both installed currently.
Comment 6 Herman Viaene 2019-12-17 14:36:40 CET
Removed offending packages one by one in MCC, then installation works OK.
Found remmina as dependent on lib64ssh4, so installed it with its vnc-plugin and then
$ strace -o lib64ssh4.txt remmina
StatusNotifier/Appindicator support: your desktop does support it and libappindicator is compiled in remmina. Good!
Checkedt trace file and found reference to /lib64/libssh.so.4.
So OK for me.
The problem with the installation might have been caused by a left-over of other updates-testing, so AFAICS no reason to withhold the update.

@ David: I am probably one of the few running tests in another language than English, and even more probably the only one in Dutch, and I consider this an important part in the testing. I do my best to provide translations, but I will show the original texts, so anyone can get it.
BTW: in odd cases, this shows that languages are mixed in some outputs.
And yes, I almost always install without the devel packages. It (sometimes, but seldom) pays off by detecting some packaging problem like in bug 25825.

Whiteboard: (none) => MGA7-64-OK

Comment 7 David Walser 2019-12-17 14:54:06 CET
For packaging issues, non-English outputs are not helpful.  I believe you can set an environment variable to get English output without changing your user settings.  As for installing without devel packages, I agree that's a good idea, but you just have to make sure that you don't already have them installed, as a partial update won't work.
Comment 8 Thomas Andrews 2019-12-17 18:17:43 CET
Validating. Advisory in Comment 2.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2019-12-19 13:43:46 CET

CC: (none) => tmb
Keywords: (none) => advisory

Comment 9 Mageia Robot 2019-12-19 14:46:02 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0402.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 10 David Walser 2019-12-20 21:27:13 CET
*** Bug 25905 has been marked as a duplicate of this bug. ***

CC: (none) => zombie.ryushu


Note You need to log in before you can comment on or make changes to this bug.