Bug 28708 - pdfbox new security issues CVE-2021-27807 and CVE-2021-27906
Summary: pdfbox new security issues CVE-2021-27807 and CVE-2021-27906
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Nicolas Lécureuil
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on: 28682 29125
Blocks: 23251
  Show dependency tree / graph
 
Reported: 2021-04-03 00:26 CEST by Nicolas Lécureuil
Modified: 2021-07-01 18:30 CEST (History)
4 users (show)

See Also:
Source RPM: pdfbox-2.0.21-2.mga8.src.rpm
CVE:
Status comment: Fixed upstream in 2.0.23

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Lécureuil 2021-04-03 00:26:21 CEST 
+++ This bug was initially created as a clone of Bug #28682 +++

Apache has issued advisories on March 19:
https://www.openwall.com/lists/oss-security/2021/03/19/9
https://www.openwall.com/lists/oss-security/2021/03/19/10

The issues are fixed upstream in 2.0.23.

Mageia 7 is also affected (see also Bug 23251).
Nicolas Lécureuil 2021-04-03 00:27:57 CEST

Depends on: 28682 => (none)

David Walser 2021-04-03 00:30:52 CEST

Depends on: (none) => 28682

David Walser 2021-04-03 00:31:41 CEST

Status comment: (none) => Fixed upstream in 2.0.23

Aurelien Oudelet 2021-04-03 20:41:34 CEST

CC: (none) => ouaurelien
Assignee: bugsquad => mageia

Comment 1 David Walser 2021-05-29 20:17:08 CEST 
Fedora has issued an advisory for this on March 26:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ/
David Walser 2021-06-13 23:44:13 CEST

Depends on: (none) => 29125

Comment 2 David Walser 2021-07-01 18:30:55 CEST 
https://blog.mageia.org/en/2021/06/08/mageia-7-will-reach-end-of-support-on-30th-of-june-the-king-is-dead-long-live-the-king/

Resolution: (none) => OLD
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.