Bug 28927 - perl-Image-ExifTool new security issue CVE-2021-22204
Summary: perl-Image-ExifTool new security issue CVE-2021-22204
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7TOO MGA7-64-OK MGA8-64-OK
Keywords: advisory, validated_update
: 28880 (view as bug list)
Depends on:
Blocks:
 
Reported: 2021-05-15 00:29 CEST by David Walser
Modified: 2021-06-16 22:24 CEST (History)
5 users (show)

See Also:
Source RPM: perl-Image-ExifTool-12.160.0-1.mga9.src.rpm
CVE: CVE-2021-22204
Status comment:


Attachments

Description David Walser 2021-05-15 00:29:55 CEST
A security issue fixed upstream in ExifTool has been announced on May 9:
https://www.openwall.com/lists/oss-security/2021/05/09/1

The issue is fixed upstream in 12.24.

A PoC is given in the reply to the message above.

Mageia 7 and Mageia 8 are also affected.
David Walser 2021-05-15 00:30:08 CEST

Whiteboard: (none) => MGA8TOO, MGA7TOO
Status comment: (none) => Fixed upstream in 12.24

Comment 1 Nicolas Salguero 2021-05-18 09:10:10 CEST
*** Bug 28880 has been marked as a duplicate of this bug. ***

CC: (none) => nicolas.salguero

Comment 3 David Walser 2021-05-28 00:19:25 CEST
Debian has issued an advisory for this on May 2:
https://www.debian.org/security/2021/dsa-4910
Comment 4 David Walser 2021-05-30 22:56:12 CEST
openSUSE has issued an advisory for this on May 10:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/
Comment 5 Nicolas Lécureuil 2021-06-12 23:50:49 CEST
Fixed in mga 7/8

src:
     - perl-Image-ExifTool-11.300.0-1.1.mga7
     - perl-Image-ExifTool-12.0.0-1.1.mga8

CC: (none) => mageia
Status comment: Fixed upstream in 12.24 => (none)
Version: Cauldron => 8
Whiteboard: MGA8TOO, MGA7TOO => MGA7TOO

Nicolas Lécureuil 2021-06-12 23:51:03 CEST

Assignee: thierry.vignaud => qa-bugs

Comment 6 Thomas Andrews 2021-06-15 22:48:59 CEST
MGA7-64-Plasma in VirtualBox. Before the update, the POC shows this:


   $ printf 'P1 1 1 0' > moo.pbm
   $ cjb2 moo.pbm moo.djvu
   $ printf 'ANTa\0\0\0\40"(xmp(\\\n".qx(cowsay pwned>&2);#"' >> moo.djvu
   $ exiftool moo.djvu > /dev/null
    _______
   < pwned >
    -------
           \   ^__^
            \  (oo)\_______
               (__)\       )\/\
                   ||----w |
                   ||     ||

No installation issues with the update. After the update, the POC commands result in no output. 

It looks like that is what is expected, so giving this an OK for MGA7.

Whiteboard: MGA7TOO => MGA7TOO MGA7-64-OK
CC: (none) => andrewsfarm

Comment 7 Thomas Andrews 2021-06-15 23:05:51 CEST
Same test as before, only with MGA8, same results. OK for MGA8. Validating. 

I gotta say, I've milked more than a few cows in my time, and some were prettier than others, but those have to be the ugliest cows I have ever dealt with. Terrible conformation, and they look underfed...

Whiteboard: MGA7TOO MGA7-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Aurelien Oudelet 2021-06-16 09:10:16 CEST
Advisory:
========================

Updates perl-Image-ExifTool package fixes a security vulnerability:

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image (CVE-2021-22204).

References:
 - https://bugs.mageia.org/show_bug.cgi?id=28927
 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22204
 - https://www.openwall.com/lists/oss-security/2021/05/09/1
 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/
 - https://www.debian.org/security/2021/dsa-4910
 - https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/
========================

Updated packages in 7/core/updates_testing:
========================
perl-Image-ExifTool-11.300.0-1.1.mga7

from SRPM:
perl-Image-ExifTool-11.300.0-1.1.mga7.src.rpm
========================

Updated packages in 8/core/updates_testing:
========================
perl-Image-ExifTool-12.0.0-1.1.mga8

from SRPM:
perl-Image-ExifTool-12.0.0-1.1.mga8.src.rpm
========================

CVE: (none) => CVE-2021-22204
Keywords: (none) => advisory
CC: (none) => ouaurelien

Comment 9 Mageia Robot 2021-06-16 22:24:02 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0259.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.