Bug 28454 - gnome-autoar new security issue CVE-2020-36241
Summary: gnome-autoar new security issue CVE-2020-36241
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7TOO MGA7-64-OK MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-02-26 19:09 CET by David Walser
Modified: 2021-03-04 17:55 CET (History)
5 users (show)

See Also:
Source RPM: gnome-autoar-0.2.4-2.mga8.src.rpm
CVE: CVE-2020-36241
Status comment:


Attachments

Description David Walser 2021-02-26 19:09:53 CET
Ubuntu has issued an advisory on February 11:
https://ubuntu.com/security/notices/USN-4733-1

Mageia 7 and Mageia 8 are also affected.
David Walser 2021-02-26 19:10:08 CET

Status comment: (none) => Patch available from upstream and Ubuntu
Whiteboard: (none) => MGA8TOO

Comment 1 David GEIGER 2021-02-27 09:32:59 CET
Done for cauldron, mga8 and mga7!

CC: (none) => geiger.david68210

Comment 2 Lewis Smith 2021-02-27 09:43:16 CET
Fabulous. So please excuse assigning it to you.

Assignee: bugsquad => geiger.david68210

Comment 3 David Walser 2021-02-27 17:39:17 CET
Package list:
libgnome-autoar0_0-0.2.3-2.1.mga7
libgnome-autoar-gir0.1-0.2.3-2.1.mga7
libgnome-autoar-devel-0.2.3-2.1.mga7
libgnome-autoar0_0-0.2.4-2.1.mga8
libgnome-autoar-gir0.1-0.2.4-2.1.mga8
libgnome-autoar-devel-0.2.4-2.1.mga8

from SRPMS:
gnome-autoar-0.2.3-2.1.mga7.src.rpm
gnome-autoar-0.2.4-2.1.mga8.src.rpm

Whiteboard: MGA8TOO => MGA7TOO
Version: Cauldron => 8
Status comment: Patch available from upstream and Ubuntu => (none)
Assignee: geiger.david68210 => qa-bugs

Comment 4 Brian Rockwell 2021-03-02 16:37:22 CET
The following 2 packages are going to be installed:

- lib64gnome-autoar-gir0.1-0.2.3-2.1.mga7.x86_64
- lib64gnome-autoar0_0-0.2.3-2.1.mga7.x86_64


worked with transferring file via gnome's file manager.  No issues.

Well, at least it doesn't seem to break anything at least.

CC: (none) => brtians1
Whiteboard: MGA7TOO => MGA7TOO MGA7-64-OK

Comment 5 Brian Rockwell 2021-03-02 16:38:05 CET
(In reply to Brian Rockwell from comment #4)
> The following 2 packages are going to be installed:
> 
> - lib64gnome-autoar-gir0.1-0.2.3-2.1.mga7.x86_64
> - lib64gnome-autoar0_0-0.2.3-2.1.mga7.x86_64
> 
> 
> worked with transferring file via gnome's file manager.  No issues.
> 
> Well, at least it doesn't seem to break anything at least.

forgot to note:  this is a gnome DE system I am testig on.
Comment 6 Brian Rockwell 2021-03-02 18:06:49 CET
gnome - mga8 - 

The following 2 packages are going to be installed:

- lib64gnome-autoar-gir0.1-0.2.4-2.1.mga8.x86_64
- lib64gnome-autoar0_0-0.2.4-2.1.mga8.x86_64


--- 

rebooted

---

file transfers done.  Nothing appears to be broken.

Whiteboard: MGA7TOO MGA7-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK

Comment 7 Thomas Andrews 2021-03-02 21:47:16 CET
Let's go with it, Brian. Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 8 David Walser 2021-03-03 00:41:43 CET
Advisory:
========================

Updated gnome-autoar packages fix security vulnerability:

Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of
the intended directory. If a user were tricked into extracting a specially
crafted archive, a remote attacker could create files in arbitrary locations,
possibly leading to code execution (CVE-2020-36241).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36241
https://ubuntu.com/security/notices/USN-4733-1
Comment 9 Aurelien Oudelet 2021-03-04 14:34:45 CET
Advisory pushed to SVN.

CVE: (none) => CVE-2020-36241
Keywords: (none) => advisory
CC: (none) => ouaurelien

Comment 10 Mageia Robot 2021-03-04 17:55:27 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0111.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.