Bug 29048 - eclipse new security issue CVE-2020-27225
Summary: eclipse new security issue CVE-2020-27225
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-05-30 23:21 CEST by David Walser
Modified: 2021-12-30 17:42 CET (History)
7 users (show)

See Also:
Source RPM: eclipse-4.17-8.mga8.src.rpm
CVE:
Status comment:


Attachments
Received an Error after updating files listed below (15.23 KB, application/x-7z-compressed)
2021-12-18 22:08 CET, Brian Rockwell
Details

Description David Walser 2021-05-30 23:21:36 CEST
openSUSE has issued an advisory on March 30:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GFMJOYKYZTYC75UCIIQQRAD674LFJI3L/

Mageia 7 and Mageia 8 are also affected.
David Walser 2021-05-30 23:21:44 CEST

Whiteboard: (none) => MGA8TOO, MGA7TOO

Comment 1 David Walser 2021-07-01 18:56:32 CEST
Removing Mageia 7 from whiteboard due to EOL:
https://blog.mageia.org/en/2021/06/08/mageia-7-will-reach-end-of-support-on-30th-of-june-the-king-is-dead-long-live-the-king/

Whiteboard: MGA8TOO, MGA7TOO => MGA8TOO

Comment 2 Nicolas Lécureuil 2021-07-24 12:13:55 CEST
updating cauldron to 4.19 as a first step

CC: (none) => mageia

Comment 3 Nicolas Lécureuil 2021-12-04 00:21:52 CET
removing cauldron. 
Eclipse will be removed from cauldron in some days.

Version: Cauldron => 8

Comment 4 David Walser 2021-12-05 17:52:48 CET
We can change the bug status once it's been removed.  I guess Fedora's dropping it?

Version: 8 => Cauldron

Comment 5 Nicolas Lécureuil 2021-12-05 18:01:06 CET
Fedora and debian too.
Comment 6 Nicolas Lécureuil 2021-12-16 16:39:30 CET
This is now fixed in mga8:


     - eclipse-4.17-8.1.mga8
rpms:
     - eclipse-p2-discovery-4.17-8.1.mga8
     - eclipse-equinox-osgi-4.17-8.1.mga8
     - eclipse-swt-4.17-8.1.mga8
     - eclipse-jdt-4.17-8.1.mga8
     - eclipse-platform-4.17-8.1.mga8
Comment 7 Nicolas Lécureuil 2021-12-16 17:19:00 CET
eclipse is now gone from cauldron. We can give this update to QA.

Version: Cauldron => 8
Assignee: java => qa-bugs
Whiteboard: MGA8TOO => (none)

Comment 8 David Walser 2021-12-16 19:42:11 CET
(In reply to Nicolas Lécureuil from comment #6)
> This is now fixed in mga8:
> 
> srpm:
>      - eclipse-4.17-8.1.mga8
> rpms:
>      - eclipse-p2-discovery-4.17-8.1.mga8
>      - eclipse-equinox-osgi-4.17-8.1.mga8
>      - eclipse-swt-4.17-8.1.mga8
>      - eclipse-jdt-4.17-8.1.mga8
>      - eclipse-platform-4.17-8.1.mga8
      - eclipse-pde-4.17-8.1.mga8
Comment 9 Herman Viaene 2021-12-17 14:52:26 CET
MGA8-64 Plasma on Lenovo B50 in Dutch
No installation issues. Selecting thee listed rpm's draws in some 40 others.
Ref bug 15073, just run it as test.
Start eclipse from CLI, opens a first window where to locate the workspace, but the window is so narrow the path is not completely visible. I think there might be an icon at it right side to open a selection window, but it isn't visible, and the launch window cann't be resized.
Accepting the default opens a browser-like window , Eclipse Platform, with a few possibilities e.g. Overview, which when clicked offers Workbench basics and Java ddevelopment.
Clicking on Workbench basics throws an error:
HTTP ERROR 500 org.apache.jasper.JasperException: PWC6033: Error in Javac compilation for JSP PWC6197: An error occurred at line: 37 in the jsp file: /index.jsp PWC6199: Generated servlet error: The method matchOnceLiveHelpToken(String) is undefined for the type BaseHelpSystem PWC6197: An error occurred at line: 37 in the jsp file: /index.jsp PWC6199: Generated servlet error: The method isAdvancedUI() is undefined for the type LayoutData PWC6199: Generated servlet error: Syntax error, insert "}" to complete Block PWC6199: Generated servlet error: Syntax error on token "}", delete this token PWC6199: Generated servlet error: Syntax error, insert "}" to complete ClassBody
Similar happens n other choices from the initial Eclipse Platform.

CC: (none) => herman.viaene

Comment 10 Brian Rockwell 2021-12-18 22:08:00 CET
Created attachment 13058 [details]
Received an Error after updating files listed below

Received an error when starting Eclipse - see attached

Also on reboot the system reported it could not start the service.

The following 4 packages are going to be installed:

- eclipse-equinox-osgi-4.17-8.1.mga8.x86_64
- eclipse-jdt-4.17-8.1.mga8.noarch
- eclipse-platform-4.17-8.1.mga8.x86_64
- eclipse-swt-4.17-8.1.mga8.x86_64

CC: (none) => brtians1

Brian Rockwell 2021-12-19 20:33:08 CET

Keywords: (none) => feedback

Comment 11 Len Lawrence 2021-12-26 17:47:20 CET
mga8, x64
Installed this some time ago and hit a problem - details hazy now.

$ rpm -qa | grep eclipse
eclipse-jdt-4.17-8.1.mga8
eclipse-emf-core-2.23.0-1.mga8
eclipse-platform-4.17-8.1.mga8
eclipse-ecf-core-3.14.17-6.mga8
eclipse-swt-4.17-8.1.mga8
eclipse-pde-4.17-8.1.mga8
eclipse-equinox-osgi-4.17-8.1.mga8
eclipse-p2-discovery-4.17-8.1.mga8

Started the application from the commandline and it displayed the workspace for the Eclipse platform.  Did not see Brian's error but the terminal said 
"Oops, secure memory pool already initialized

(Eclipse:28355): Gtk-CRITICAL **: 16:22:35.317: gtk_box_gadget_distribute: assertion 'size >= 0' failed in GtkScrollbar
"
The GtkScrollbar errors were repeated endlessly.  Starting from the system menus these messages would not be seen so are probably innocuous.

The outline section was empty.
The package explorer panel showed "org.eclipse.ui.examples.readmetool" and the Welcome panel displayed the content.
The problems tab gave 4 errors and 32 warnings, all Plug-in problems.

Back to the package explorer:
Under doc, double-clicking on the section parser section displays information in the file display window.

At this entry level the gui works.  Is that sufficient to pass it?

CC: (none) => tarazed25

Comment 12 David Walser 2021-12-26 17:48:46 CET
Barring any regressions, yes.
Comment 13 Len Lawrence 2021-12-27 01:44:52 CET
Thanks David.
@brian - Any objections to removing feedback?
Len Lawrence 2021-12-29 17:56:58 CET

Keywords: feedback => (none)

Len Lawrence 2021-12-29 17:57:58 CET

Whiteboard: (none) => MGA8-64-OK

Comment 14 Thomas Andrews 2021-12-30 00:15:29 CET
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2021-12-30 03:30:37 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 15 Mageia Robot 2021-12-30 17:42:59 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0591.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.