Hi, thanks for reporting this.
As there is no maintainer for this package I added the committers in CC.

(Please set the status to 'assigned' if you are working on it)

Assignee: bugsquad => pkg-bugs
CC: (none) => geiger.david68210, jani.valimaa, ouaurelien

Freeze push asked to added the two upstream patches!

Done for both mga8 and mga7 in Core/updates_testing repo!

Since we're apparently not allowed to fix anything else before the Mageia 8 release, this will have to wait and be re-pushed later.

Saving the Mageia 7 package list:
connman-1.37-1.1.mga7
connman-devel-1.37-1.1.mga7

Whiteboard: MGA7TOO => MGA8TOO, MGA7TOO
Status comment: Patches available from upstream => Patched in SVN

If it is tested on mga8 it can be moved to Core/Release, so please if someone can test it, thanks in advance!

things can still be fixed, but as we are past release freeze I demand atleast some actual testing to be done before allowing the changes in.

I'm trying to ensure a stable final release process

and you know just as well as me that just because something builds does not actually always mean it works, and I dont want to introduce more breakages in a stable tree at this point...

yes, there can still be some subtle bugs showing up, but atleast the most obvious issues should hopefylly show up with some testing

M8 Plasma x86_64
Note that network OK over WiFi with existing net_applet.

need to disable it for this.
See: https://wiki.mageia.org/en/Switching_to_networkmanager for command on how to deactivate legacy network scripts and DO NOT install/activate NetworkManager.
Deactivate net_applet with right-click on it.

# urpmi connman 
connman-1.38-1.mga8 with core/release

# systemctl start connman.service

# connmanctl enable wifi
# connmanctl scan wifi
To list the available networks 

$ connmanctl
connmanctl> scan wifi
connmanctl> services
connmanctl> agent on
connmanctl> connect wifi_CENSORED_managed_psk

Agent RequestInput wifi_CENSORED_managed_psk
  Passphrase = [ Type=psk, Requirement=mandatory ]
  Passphrase?  

connmanctl> quit

# systemctl enable connman.service
# systemctl enable connman-wait-online.service

WiFi OK, running. Carrying over a reboot. WiFi OK

Then,
Use QA Repo to install connman-1.38-2.mga8.x86_64.rpm from 8/updates_testing
Install OK.

Same functionality. No errors.

Basic functionalities are OK.
Returning to the Security Vulnerability,
It was reported a remote (adjacent network) code execution flaw in
connman: a stack buffer overflow that can be used to execute code by network adjacent attackers ;
and a Remote stack information leak which can be used to help execute the first  reliably. 2 vulnerabilities. Beyond the scope of my understanding.
Fixes are publicly commited in kernel.org git.

So a OK on this, based on installing and updating.

Thanks Aurélien.  Please comment on the freeze push/move request for this package on the dev ml that you've successfully tested it.

*** Bug 28381 has been marked as a duplicate of this bug. ***

CC: (none) => zombie_ryushu

Debian has issued an advisory for this on February 8:
https://www.debian.org/security/2021/dsa-4847

seems pushed on the BS

CC: (none) => mageia
Assignee: pkg-bugs => qa-bugs
Status comment: Patched in SVN => (none)

In Cauldron?

Assignee: qa-bugs => pkg-bugs

sorry i was wrong.

Conman now pushed in cauldron/mga8

src:
    connman-1.38-2.mga8
    connman-1.37-1.1.mga7

Assignee: pkg-bugs => qa-bugs

Package list for Mageia 8:
connman-1.38-2.mga8
connman-devel-1.38-2.mga8

from connman-1.38-2.mga8.src.rpm

Whiteboard: MGA8TOO, MGA7TOO => MGA7TOO
Version: Cauldron => 8

Already fixed and pushed for mga8 before mga8 released!

That was the problem David.  We wipe updates_testing at release time.

connman-1.38-2.mga8 was already tested and pushed to Core/Release before mga8 released!

So need just some test for mga7.

Version: 8 => 7
Whiteboard: MGA7TOO => (none)
Source RPM: connman-1.38-1.mga8.src.rpm => connman-1.37-1.mga7.src.rpm

Advisory:
========================

Updated connman packages fix security vulnerabilities:

A remote information leak vulnerability and a remote buffer overflow vulnerability were discovered in ConnMan, which could result in denial of
service or the execution of arbitrary code (CVE-2021-26675, CVE-2021-26676).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26675
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26676
https://www.debian.org/security/2021/dsa-4847

MGA 7-64 MATE on Peaq C1011.
Installation of connman works OK, but
# urpmi connman-devel
The following packages can't be installed because they depend on packages
that are older than the installed ones:
lib64blkid-devel-2.33.2-1.mga7
lib64mount-devel-2.33.2-1.mga7
lib64glib2.0-devel-2.60.2-1.4.mga7
connman-devel-1.37-1.1.mga7

Continuing .....

CC: (none) => herman.viaene

# systemctl start connman.service
This disconnects the existing wifi connection

# systemctl -l status connman.service
● connman.service - Connection service
   Loaded: loaded (/usr/lib/systemd/system/connman.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2021-03-25 10:57:26 CET; 29s ago
 Main PID: 30779 (connmand)
    Tasks: 1 (limit: 2285)
   Memory: 5.1M
   CGroup: /system.slice/connman.service
           └─30779 /usr/sbin/connmand -n

Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: Could not read the UART name
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: lo {newlink} index 1 address 00:00:00:00:00:00 mtu 65536
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: lo {newlink} index 1 operstate 0 <UNKNOWN>
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: wlan0 {create} index 2 type 1 <ETHER>
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: wlan0 {RX} 4683 packets 5236772 bytes
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: wlan0 {TX} 3021 packets 346127 bytes
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: wlan0 {update} flags 36866 <DOWN>
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: wlan0 {newlink} index 2 address 80:A5:89:2E:7D:05 mtu 1500
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: wlan0 {newlink} index 2 operstate 2 <DOWN>
Mar 25 10:57:27 mach7.hviaene.thuis connmand[30779]: Adding interface wlan0 [ wifi ]

# connmanctl enable wifi
Enabled wifi
# connmanctl scan wifi
Scan completed for wifi
But it dies not show any scan results, is that to be expected??
# systemctl enable connman.service
Created symlink /etc/systemd/system/multi-user.target.wants/connman.service → /usr/lib/systemd/system/connman.service.
# systemctl enable connman-wait-online.service
Created symlink /etc/systemd/system/network-online.target.wants/connman-wait-online.service → /usr/lib/systemd/system/connman-wait-online.service.
 Then as normal user
$ connmanctl
connmanctl> scan wifi
Scan completed for wifi
connmanctl> services
This shows a list of possible wifi connections
connmanctl> agent on
Agent registered
connmanctl> connect <my-own-_managed_psk>
Agent RequestInput <my-own-_managed_psk>
  Passphrase = [ Type=psk, Requirement=mandatory, Alternates=[ WPS ] ]
  WPS = [ Type=wpspin, Requirement=alternate ]
Passphrase? <mypasswd>
Agent ReportError <my-own-_managed_psk>
  connect-failed

I had to use MCC- Setup a new network interface (accepting the values already defined, to get my wifi back alive.

(In reply to Aurelien Oudelet from comment #7)
> M8 Plasma x86_64
> Note that network OK over WiFi with existing net_applet.
> 
> need to disable it for this.
> See: https://wiki.mageia.org/en/Switching_to_networkmanager for command on
> how to deactivate legacy network scripts and DO NOT install/activate
> NetworkManager.
> Deactivate net_applet with right-click on it.
> 
> # urpmi connman 
> connman-1.38-1.mga8 with core/release
> 
> # systemctl start connman.service
> 
> # connmanctl enable wifi
> # connmanctl scan wifi
> To list the available networks 
> 
> $ connmanctl
> connmanctl> scan wifi
> connmanctl> services
> connmanctl> agent on
> connmanctl> connect wifi_CENSORED_managed_psk
> 
> Agent RequestInput wifi_CENSORED_managed_psk
>   Passphrase = [ Type=psk, Requirement=mandatory ]
>   Passphrase?  
> 
> connmanctl> quit
> 
> # systemctl enable connman.service
> # systemctl enable connman-wait-online.service
> 
> WiFi OK, running. Carrying over a reboot. WiFi OK
> 
> Then,
> Use QA Repo to install connman-1.38-2.mga8.x86_64.rpm from 8/updates_testing
> Install OK.
> 
> Same functionality. No errors.
> 
> Basic functionalities are OK.
> Returning to the Security Vulnerability,
> It was reported a remote (adjacent network) code execution flaw in
> connman: a stack buffer overflow that can be used to execute code by network
> adjacent attackers ;
> and a Remote stack information leak which can be used to help execute the
> first  reliably. 2 vulnerabilities. Beyond the scope of my understanding.
> Fixes are publicly commited in kernel.org git.
> 
> So a OK on this, based on installing and updating.

This is also OK on mageia 7 with an Intel AX200 WiFi 6 card. Adapting the correct rpm names.

Strange Herman you get errors.

I do not see any on my device.
Advisory committed.

Keywords: (none) => advisory

Trying to look at the differences in your procedures, to try to pinpoint why Herman had problems where Aurelien didn't:

Aurelien, you deactivated the net_applet, which should have deactivated your Internet connection, and THEN installed connman. How did you do that? A private repo, perhaps, not involving the Internet for the installation?

Also, you installed connman from somewhere, ran through the setup, and then went after the update, where Herman got the update and then tried to set it up.

Do I have any of this correct?

CC: (none) => andrewsfarm

So I gave it a try myself. I was more successful than Herman, but less so than Aurelien - I think due to user error.

I installed connman-1.37-1.mga7 using qarepo and drakrpm from scratch, not as an update, with no errors. (@Herman: selecting the devel package did not show any conflicts, though I didn't actually go through with installing it.)

Told the net_applet to quit, then:

[root@localhost ~]# systemctl start connman (which notified me that the wifi connection was now broken)
[root@localhost ~]# systemctl status connman
● connman.service - Connection service
   Loaded: loaded (/usr/lib/systemd/system/connman.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2021-04-22 14:05:39 EDT; 1min 21s ago
 Main PID: 3915 (connmand)
    Tasks: 1 (limit: 4915)
   Memory: 2.6M
   CGroup: /system.slice/connman.service
           └─3915 /usr/sbin/connmand -n

Apr 22 14:06:41 localhost connmand[3915]: wlo1 {RX} 5 packets 838 bytes
Apr 22 14:06:41 localhost connmand[3915]: wlo1 {TX} 11 packets 1526 bytes
Apr 22 14:06:41 localhost connmand[3915]: wlo1 {update} flags 102403 <UP,LOWER_UP>
Apr 22 14:06:41 localhost connmand[3915]: wlo1 {newlink} index 3 address 58:94:6B:02:7D:E4 mtu 1500
Apr 22 14:06:41 localhost connmand[3915]: wlo1 {newlink} index 3 operstate 5 <DORMANT>
Apr 22 14:06:42 localhost connmand[3915]: wlo1 {RX} 5 packets 838 bytes
Apr 22 14:06:42 localhost connmand[3915]: wlo1 {TX} 11 packets 1526 bytes
Apr 22 14:06:42 localhost connmand[3915]: wlo1 {update} flags 36867 <UP>
Apr 22 14:06:42 localhost connmand[3915]: wlo1 {newlink} index 3 address 58:94:6B:02:7D:E4 mtu 1500
Apr 22 14:06:42 localhost connmand[3915]: wlo1 {newlink} index 3 operstate 2 <DOWN>

After which I tried Aurelien's examples, successfully, until it came time to make the connection. That failed, because of an "input/output error" of the passphrase. I was unable to determine what, exactly, that input/output error was.

At any rate, I think I got far enough to believe this is working as designed. Knowing even less about wifi than either Herman or Aurelien, I don't have a clue about why Herman had problems.

I'm going to OK it, and validate. Advisory already committed.

Whiteboard: (none) => MGA7-64-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0195.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED