TigerVNC 1.11.0 has been released on September 9, fixing a security issue: https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0 It also supports newer X.org server versions, which we will need for it to continue to be buildable for mga8.
tigervnc has neither registered nor consistent maintainer, so having to assign this globally.
Assignee: bugsquad => pkg-bugs
The build fails with an error I do not know how to solve: """ [100%] Generating VncViewer.jar /usr/bin/jar cfm VncViewer.jar /home/iurt/rpmbuild/BUILD/tigervnc-1.11.0/java/com/tigervnc/vncviewer/MANIFEST.MF com/tigervnc/vncviewer/timestamp com/tigervnc/vncviewer/*.class com/tigervnc/rfb/*.class com/tigervnc/rdr/*.class com/tigervnc/network/*.class com/jcraft/jzlib/*.class com/jcraft/jsch/jcraft/*.class com/jcraft/jsch/jce/*.class com/jcraft/jsch/*.class com/tigervnc/vncviewer/*.png com/tigervnc/vncviewer/tigervnc.ico /usr/bin/cmake -DJava_PATH=/usr/bin/ -DJAR_FILE=/home/iurt/rpmbuild/BUILD/tigervnc-1.11.0/java/build/VncViewer.jar -DJAVA_KEYSTORE=NOTFOUND -DJAVA_KEYSTORE_TYPE=jks -DJAVA_STOREPASS=NOTFOUND -DJAVA_KEYPASS=NOTFOUND -DJAVA_KEY_ALIAS=NOTFOUND -DJAVA_TSA_URL=NOTFOUND -P /home/iurt/rpmbuild/BUILD/tigervnc-1.11.0/java/cmake/SignJar.cmake -- Generating self-signed certificate -- Signing /home/iurt/rpmbuild/BUILD/tigervnc-1.11.0/java/build/VncViewer.jar CMake Error at /home/iurt/rpmbuild/BUILD/tigervnc-1.11.0/java/cmake/SignJar.cmake:66 (message): /usr/bin//jarsigner failed: Exception in thread "main" java.lang.ExceptionInInitializerError Caused by: java.lang.IllegalArgumentException: Error in security property. Constraint unknown: c2tnb191v1 at java.base/sun.security.util.DisabledAlgorithmConstraints$Constraints.<init>(DisabledAlgorithmConstraints.java:376) at java.base/sun.security.util.DisabledAlgorithmConstraints.<init>(DisabledAlgorithmConstraints.java:125) at java.base/sun.security.util.DisabledAlgorithmConstraints.<init>(DisabledAlgorithmConstraints.java:92) at jdk.jartool/sun.security.tools.jarsigner.Main.<clinit>(Main.java:98) gmake[2]: *** [CMakeFiles/java.dir/build.make:149: VncViewer.jar] Error 1 gmake[2]: *** Deleting file 'VncViewer.jar' gmake[2]: Leaving directory '/home/iurt/rpmbuild/BUILD/tigervnc-1.11.0/java/build' gmake[1]: *** [CMakeFiles/Makefile2:98: CMakeFiles/java.dir/all] Error 2 gmake[1]: Leaving directory '/home/iurt/rpmbuild/BUILD/tigervnc-1.11.0/java/build' gmake: *** [Makefile:106: all] Error 2 error: Bad exit status from /home/iurt/rpmbuild/tmp/rpm-tmp.61FoV8 (%build) """ See for instance: http://pkgsubmit.mageia.org/uploads/failure/cauldron/core/release/20200917141759.ns80.duvel.45080/log/tigervnc-1.11.0-1.mga8/build.0.20200917143932.log
CC: (none) => nicolas.salguero
CC: (none) => geiger.david68210, mageia
Don't know if this helps, but c2tnb191v1 is listed as a type of ECC Curve at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Config_Options
CC: (none) => davidwhodgins
Hi, Ok I found the problem: in java 11 security properties, a new property was added, named "jdk.disabled.namedCurves". The problem is: that property has some values in its list that contains a space in their name and the first of those problematic values is "X9.62 c2tnb191v1". With this space, the value is viewed as disabled algorithm: X9.62 with a constraint named c2tnb191v1 whereas the value should be viewed as disabled algorithm: X9.62 c2tnb191v1. Sadly, all I tried to escape the space did not work. Best regards, Nico.
Can the Java stuff in tigervnc be disabled?
Depends on: (none) => 27289
Fedora has issued an advisory for this on September 14: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XJC7PGEFEUUZTWSX7CGQG5YLB3NCQ6BO/
Debian-LTS has issued an advisory for this on October 6: https://www.debian.org/lts/security/2020/dla-2396
Severity: normal => majorSummary: tigervnc 1.11.0 fixes security issue with TLS connections => tigervnc 1.11.0 fixes security issue with TLS connections (CVE-2020-26117)
openSUSE has issued an advisory for this today (October 13): https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html
Whiteboard: (none) => MGA7TOO
Suggested advisory: ======================== The updated packages fix a security vulnerability: In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception. (CVE-2020-26117) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26117 https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XJC7PGEFEUUZTWSX7CGQG5YLB3NCQ6BO/ https://www.debian.org/lts/security/2020/dla-2396 https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html ======================== Updated packages in core/updates_testing: ======================== tigervnc-1.10.1-1.2.mga7 tigervnc-server-1.10.1-1.2.mga7 tigervnc-server-module-1.10.1-1.2.mga7 tigervnc-java-1.10.1-1.2.mga7 from SRPM: tigervnc-1.10.1-1.2.mga7.src.rpm
Status: NEW => ASSIGNEDVersion: Cauldron => 7CVE: (none) => CVE-2020-26117Whiteboard: MGA7TOO => (none)Assignee: pkg-bugs => qa-bugsSource RPM: tigervnc-1.10.1-3.mga8.src.rpm => tigervnc-1.10.1-1.1.mga7.src.rpm
MGA7-64 Plasma on Lenovo B50 No installation issues Ref bug 25917 for tests # systemctl -l status vncserver ● vncserver.service - LSB: Start TigerVNC server at boot time Loaded: loaded (/etc/rc.d/init.d/vncserver; generated) Active: inactive (dead) Docs: man:systemd-sysv-generator(8) # systemctl start vncserver # systemctl -l status vncserver ● vncserver.service - LSB: Start TigerVNC server at boot time Loaded: loaded (/etc/rc.d/init.d/vncserver; generated) Active: active (exited) since Fri 2020-10-16 16:29:57 CEST; 4s ago Docs: man:systemd-sysv-generator(8) Process: 15435 ExecStart=/etc/rc.d/init.d/vncserver start (code=exited, status=0/SUCCESS) Oct 16 16:29:57 mach5.hviaene.thuis systemd[1]: Starting LSB: Start TigerVNC server at boot time... Oct 16 16:29:57 mach5.hviaene.thuis vncserver[15435]: Starting vncserver: [ OK ] Oct 16 16:29:57 mach5.hviaene.thuis systemd[1]: Started LSB: Start TigerVNC server at boot time. # vncpasswd Password: Verify: Would you like to enter a view-only password (y/n)? n But then as usual,first open up port 5900:5902/tcp in firewall, but trying to connect, runs into CConn: unable connect to socket: Connection refused (111) I've never got this working.
CC: (none) => herman.viaene
Installed and tested without issues. Tested remote and local server to local client connections. No issues. System: Mageia 7, x86_64, Plasma DE, LXQt DE, Intel CPU, nVidia GPU using nvidia-current proprietary driver. $ uname -a Linux marte 5.7.19-desktop-1.mga7 #1 SMP Thu Aug 27 20:27:55 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux $ rpm -qa | grep tigervnc | sort tigervnc-1.10.1-1.2.mga7 tigervnc-server-1.10.1-1.2.mga7 tigervnc-server-module-1.10.1-1.2.mga7 ########################### $ vncserver -fg New 'marte:1 (pclx)' desktop is marte:1 Starting applications specified in /home/pclx/.vnc/xstartup Log file is /home/pclx/.vnc/marte:1.log Killing Xvnc process ID 16621 ########################### $ vncviewer localhost:1 TigerVNC Viewer 64-bit v1.10.1 Built on: 2020-10-15 09:41 Copyright (C) 1999-2019 TigerVNC Team and many others (see README.rst) See https://www.tigervnc.org for information on TigerVNC. Sun Oct 18 00:49:04 2020 DecodeManager: Detected 4 CPU core(s) DecodeManager: Creating 4 decoder thread(s) CConn: Connected to host localhost port 5901 CConnection: Server supports RFB protocol version 3.8 CConnection: Using RFB protocol version 3.8 CConnection: Choosing security type VeNCrypt(19) CVeNCrypt: Choosing security type TLSVnc (258) Sun Oct 18 00:49:10 2020 DesktopWindow: Adjusting window size to avoid accidental full screen request CConn: Using pixel format depth 24 (32bpp) little-endian rgb888 CConnection: Enabling continuous updates Sun Oct 18 00:50:17 2020 CConn: End of stream
CC: (none) => mageia
Whiteboard: (none) => MGA7-64-OK
Validating update ; packages and advisory on Comment 9. Advisory done.
CC: (none) => ouaurelien
CC: (none) => sysadmin-bugsKeywords: (none) => advisory, validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0388.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED