Bug 26715 - perl new security issues CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723 (also update to 5.28.3)
Summary: perl new security issues CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723 (a...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-06-02 16:39 CEST by Thierry Vignaud
Modified: 2020-06-11 02:00 CEST (History)
6 users (show)

See Also:
Source RPM: perl-5.28.2-2.mga7.src.rpm
CVE:
Status comment:


Attachments

Description Thierry Vignaud 2020-06-02 16:39:59 CEST
Advisory:
==========
This update from 5.28.2 to 5.28.3 fixes bugs several bugs the RPM package manager.
- Update to 5.23.3 (See https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod for release notes)
- Security release fixes CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723
- Work around a glibc bug in caching LC_MESSAGES (GH#17081)
- Fix POSIX:setlocale() documentation
- Prevent from an integer overflow in POSIX::SigSet()
- Fix thread-safety of IO::Handle (GH#14816)
- Close :unix PerlIO layers properly (bug #987118)
- Fix counting a recursion limit when matching in a postponed eval (GH#17490)
- Fix sorting tied arrays (GH#17496)
- Fix a spurious warning about a multidimensional syntax (GH#16535)
- Normalize "#!/perl" shebangs in the tests
- Fix a warning about an uninitialized value in B::Deparse (GH#17537)
- Fix Time-Local tests to pass after year 2019 (CPAN RT#124787)

List of generated packages:
=============================
perl-5.28.3-2.mga7.i586.rpm
perl-base-5.28.3-2.mga7.i586.rpm
perl-devel-5.28.3-2.mga7.i586.rpm
perl-doc-5.28.3-2.mga7.noarch.rpm
perl-debugsource-5.28.3-2.mga7.i586.rpm
perl-debuginfo-5.28.3-2.mga7.i586.rpm
perl-base-debuginfo-5.28.3-2.mga7.i586.rpm

(s/lib64/lib/ + s/x86_64/i586/ for i586)
(likewas for armv7 vs aarch64)
Comment 1 Lewis Smith 2020-06-02 21:24:53 CEST
Several questions:
- Why is the package list just for i586?
- Why are they for Perl rather than the SRPM cited 'rpm'? Should the latter be changed to, or have added, 'perl'?
- For the Advisory, which SRPM/s is/are the one/s that matter/s?
- Whatever the package list really is, are they in updates/testing for QA?
Comment 2 Nicolas Lécureuil 2020-06-02 22:42:12 CEST
List of generated packages:
=============================
perl-5.28.3-2.mga7
perl-base-5.28.3-2.mga7
perl-devel-5.28.3-2.mga7
perl-doc-5.28.3-2.mga7
perl-debugsource-5.28.3-2.mga7
perl-debuginfo-5.28.3-2.mga7
perl-base-debuginfo-5.28.3-2.mga7


from:  perl-5.28.3-2.mga7.src.rpm
Comment 3 David Walser 2020-06-02 23:42:06 CEST
Lewis, just ignore the arch part.  As for the rest, it's because for some reason Thierry keeps making new bugs by cloning old ones instead of just making a fresh new bug.

Component: RPM Packages => Security
QA Contact: (none) => security
CC: andrewsfarm, fri, herman.viaene, qa-bugs, sysadmin-bugs, tmb, wilcal.int => (none)
Source RPM: rpm-4.14.3-1.mga7..src.rpm => perl-5.28.2-2.mga7.src.rpm
Keywords: advisory, validated_update => (none)

David Walser 2020-06-02 23:42:36 CEST

Depends on: 19710, 26576 => (none)
Assignee: bugsquad => qa-bugs

David Walser 2020-06-02 23:43:22 CEST

Summary: Update candidate: perl => perl new security issues fixes CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723 (also update to 5.28.3)

David Walser 2020-06-02 23:43:29 CEST

Summary: perl new security issues fixes CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723 (also update to 5.28.3) => perl new security issues CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723 (also update to 5.28.3)

Comment 4 David Walser 2020-06-02 23:57:04 CEST
Please don't list debug* packages for QA, it just creates confusion.
Comment 5 Thierry Vignaud 2020-06-03 00:59:10 CEST
I though that was needed for the push from core/updates_testing into core/updates
Comment 6 Herman Viaene 2020-06-03 14:15:54 CEST
MGA7-64 Plasma on Lenovo B50
No installation issues.
Following Len's lead in bug 25980, installed Frozen Bubble using gurmpi (why specifically that?).
Played and won one level!!!!!!
So OK.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => herman.viaene

Comment 7 Nicolas Lécureuil 2020-06-03 16:26:55 CEST
(In reply to Thierry Vignaud from comment #5)
> I though that was needed for the push from core/updates_testing into
> core/updates

no need because the script that upload uses the src.rpm names.

The name of the rpms are needed for QA team to know what to install.


But thank you for the update :)
Comment 8 Thomas Andrews 2020-06-05 13:31:47 CEST
Careful Herman, Frozen Bubble can be addictive...

Validating. Advisory in Comment 0.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Nicolas Lécureuil 2020-06-11 01:26:21 CEST

Keywords: (none) => advisory

Comment 9 Mageia Robot 2020-06-11 02:00:50 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0255.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.