Bug 28553 - gnuplot security update for CVE-2020-25559 and fix for gnuplot-qt-5.2.2-5 missing dependencies on gnuplot-nox and gnuplot
Summary: gnuplot security update for CVE-2020-25559 and fix for gnuplot-qt-5.2.2-5 mis...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 28463
  Show dependency treegraph
 
Reported: 2021-03-08 14:37 CET by Thomas Andrews
Modified: 2021-03-12 02:27 CET (History)
5 users (show)

See Also:
Source RPM: gnuplot-5.2.2-5mga7
CVE: CVE-2020-25559
Status comment:


Attachments

Description Thomas Andrews 2021-03-08 14:37:34 CET
Description of problem:

While testing Bug 28463 I uncovered a dependency problem with gnuplot-qt. If a Plasma user installs that alone, it will not draw in any dependencies. Once installed, it does not work properly - practically unusable. Installing gnuplot-nox makes it usable, indicating that it ought to be a dependency.

The Mageia 8 gnuplot-qt has dependencies of both gnuplot-nox and gnuplot.

Version-Release number of selected component (if applicable):

gnuplot-qt-5.2.2-5.1.mga7

How reproducible: Always, if the user installs gnuplot-qt by itself
Comment 1 Aurelien Oudelet 2021-03-08 20:41:36 CET
Seems a dependency issue.

But: https://bugs.mageia.org/show_bug.cgi?id=27189 !! Should already be fixed.
Since:
r1618670 | neoclust | 2020-08-24 21:30:38 +0200 (lun. 24 août 2020) | 1 ligne

Requires gnuplot in gnuplot-qt (mga#27189)

*** This bug has been marked as a duplicate of bug 27189 ***

CC: (none) => ouaurelien
Status: NEW => RESOLVED
Resolution: (none) => DUPLICATE
Assignee: bugsquad => pkg-bugs

Comment 2 Aurelien Oudelet 2021-03-08 20:42:53 CET
So sorry. Too fast reading... this is for Mageia 7!

Resolution: DUPLICATE => (none)
Status: RESOLVED => REOPENED

Comment 3 Aurelien Oudelet 2021-03-08 20:45:49 CET
As there is no maintainer for this package I added the committers in CC.

CC: (none) => mageia, nicolas.salguero

Comment 4 Lewis Smith 2021-03-08 21:29:11 CET
Thanks TJ for reporting this, and finding the problem:
$ urpmq --requires gnuplot-qt | grep -v lib
$
$ urpmq --whatrequires gnuplot
[no mention of gnuplot-qt]
$ urpmq --whatrequires gnuplot-nox
gnuplot
+ ...
$ urpmq --requires gnuplot | grep -v lib
gnuplot-nox[== 5.2.2-5.mga7]

So here it looks as if just a requires of gnuplot from gnuplot-qt would suffice.
Comment 5 David GEIGER 2021-03-09 06:35:48 CET
Fixed in next gnuplot-5.2.2-5.2.mga7 update!

CC: (none) => geiger.david68210

Comment 6 Aurelien Oudelet 2021-03-11 22:49:56 CET
Imported from Bug 28463

Advisory:
========================

Updated gnuplot packages fix security vulnerability:

Double free when executing print_set_output() (CVE-2020-25559).

Additionally, a missing require for gnuplot has been added to
gnuplot-qt package.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25559
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CKEZYDL7ZTBAXXRLNGPXPFNXRKWZ3MXC/
========================

Updated packages in core/updates_testing:
========================
gnuplot-5.2.2-5.2.mga7
gnuplot-mode-5.2.2-5.2.mga7
gnuplot-nox-5.2.2-5.2.mga7
gnuplot-qt-5.2.2-5.2.mga7

from SRPM gnuplot-5.2.2-5.2.mga7

Assigning to QA.

Status: REOPENED => ASSIGNED
QA Contact: (none) => security
Component: RPM Packages => Security
Assignee: pkg-bugs => qa-bugs
Summary: gnuplot-qt-5.2.2-5.1 is missing dependencies on gnuplot-nox and gnuplot => gnuplot security uipdate and fix for gnuplot-qt-5.2.2-5 missing dependencies on gnuplot-nox and gnuplot

Aurelien Oudelet 2021-03-11 22:50:40 CET

Summary: gnuplot security uipdate and fix for gnuplot-qt-5.2.2-5 missing dependencies on gnuplot-nox and gnuplot => gnuplot security update for CVE-2020-25559 and fix for gnuplot-qt-5.2.2-5 missing dependencies on gnuplot-nox and gnuplot
CVE: (none) => CVE-2020-25559
Source RPM: gnuplot-5.2.2-5.1.mga7 => gnuplot-5.2.2-5mga7

Comment 7 Thomas Andrews 2021-03-11 23:46:04 CET
Removed all earlier installs of gnuplot, then installed gnuplot-qt, which did not pull in any dependencies. Checked it out using demo scripts from http://www.gnuplot.info/demo/ and none of the ones I tried worked.

Used qarepo to get the packages in Comment 6, and then updated, which pulled in gnuplot and gnuplot-nox. Tried the demos again, and all worked.

This looks OK. Validating. Advisory in Comment 6.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update
Whiteboard: (none) => MGA7-64-OK

Comment 8 Aurelien Oudelet 2021-03-11 23:56:15 CET
Advisory committed to SVN.

Keywords: (none) => advisory

David Walser 2021-03-12 01:41:46 CET

Blocks: (none) => 28463

Comment 9 David Walser 2021-03-12 01:42:54 CET
All of this should have been done in the other bug, but whatever.
Comment 10 Mageia Robot 2021-03-12 02:27:43 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0127.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.