Bug 29452 - gstreamer1.0 new security issues fixed upstream in 1.18.5
Summary: gstreamer1.0 new security issues fixed upstream in 1.18.5
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-09-09 15:09 CEST by David Walser
Modified: 2021-09-29 19:24 CEST (History)
5 users (show)

See Also:
Source RPM: gstreamer1.0, gstreamer1.0-*
CVE:
Status comment:


Attachments

Description David Walser 2021-09-09 15:09:15 CEST
GStreamer 1.18.5 has been released on September 8, including security fixes:
https://gstreamer.freedesktop.org/releases/1.18/#1.18.5

We should update Mageia 8 and Cauldron.
David Walser 2021-09-09 15:09:22 CEST

Whiteboard: (none) => MGA8TOO

Comment 1 David Walser 2021-09-18 19:09:11 CEST
Updated packages uploaded for Mageia 8 and Cauldron by Jani.

SRPMS:
gstreamer1.0-1.18.5-1.mga8
gstreamer1.0-plugins-base-1.18.5-1.mga8
gstreamer1.0-plugins-good-1.18.5-1.mga8
gstreamer1.0-plugins-bad-1.18.5-1.mga8
gstreamer1.0-plugins-ugly-1.18.5-1.mga8
gstreamer1.0-plugins-bad-1.18.5-1.mga8
gstreamer1.0-plugins-ugly-1.18.5-1.mga8
gstreamer1.0-devtools-1.18.5-1.mga8
gstreamer1.0-editing-services-1.18.5-1.mga8
gstreamer1.0-libav-1.18.5-1.mga8
gstreamer1.0-omx-1.18.5-1.mga8
gstreamer1.0-python-1.18.5-1.mga8
gstreamer1.0-rtsp-server-1.18.5-1.mga8
gstreamer1.0-vaapi-1.18.5-1.mga8

Assignee: jani.valimaa => qa-bugs
CC: (none) => jani.valimaa
Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8

Comment 2 David Walser 2021-09-18 19:11:29 CEST
(In reply to David Walser from comment #1)
> Updated packages uploaded for Mageia 8 and Cauldron by Jani.
> 
> SRPMS:
> gstreamer1.0-plugins-bad-1.18.5-1.mga8
> gstreamer1.0-plugins-ugly-1.18.5-1.mga8

These two duplicated because they're both in core and tainted.
Comment 3 David Walser 2021-09-18 19:16:36 CEST
RPMS:
libgstreamer1.0_0-1.18.5-1.mga8
gstreamer1.0-tools-1.18.5-1.mga8
libgst-gir1.0-1.18.5-1.mga8
gstreamer1.0-plugins-base-1.18.5-1.mga8
libgstreamer-plugins-base1.0_0-1.18.5-1.mga8
libgstreamer-plugins-base1.0-devel-1.18.5-1.mga8
libgstgl1.0_0-1.18.5-1.mga8
libgstreamer-plugins-base-gir1.0-1.18.5-1.mga8
gstreamer1.0-cdparanoia-1.18.5-1.mga8
libgstgl-gir1.0-1.18.5-1.mga8
gstreamer1.0-libvisual-1.18.5-1.mga8
gstreamer1.0-pulse-1.18.5-1.mga8
gstreamer1.0-vp8-1.18.5-1.mga8
gstreamer1.0-soup-1.18.5-1.mga8
gstreamer1.0-flac-1.18.5-1.mga8
gstreamer1.0-dv-1.18.5-1.mga8
gstreamer1.0-jack-1.18.5-1.mga8
gstreamer1.0-raw1394-1.18.5-1.mga8
gstreamer1.0-speex-1.18.5-1.mga8
gstreamer1.0-wavpack-1.18.5-1.mga8
gstreamer1.0-aalib-1.18.5-1.mga8
gstreamer1.0-plugins-good-1.18.5-1.mga8
gstreamer1.0-twolame-1.18.5-1.mga8
gstreamer1.0-lame-1.18.5-1.mga8
gstreamer1.0-caca-1.18.5-1.mga8
libgstreamer-plugins-bad1.0-devel-1.18.5-1.mga8
libgstcodecparsers1.0_0-1.18.5-1.mga8
gstreamer1.0-dash-1.18.5-1.mga8
gstreamer1.0-plugins-bad-1.18.5-1.mga8
libgstmpegts1.0_0-1.18.5-1.mga8
libgstplayer1.0_0-1.18.5-1.mga8
gstreamer1.0-curl-1.18.5-1.mga8
libgstcodecs1.0_0-1.18.5-1.mga8
gstreamer1.0-mpeg2enc-1.18.5-1.mga8
gstreamer1.0-transcoder-1.18.5-1.mga8
libgstbadaudio1.0_0-1.18.5-1.mga8
gstreamer1.0-srtp-1.18.5-1.mga8
libgirgstmpegts-gir1.0-1.18.5-1.mga8
gstreamer1.0-ladspa-1.18.5-1.mga8
gstreamer1.0-smoothstreaming-1.18.5-1.mga8
gstreamer1.0-libass-1.18.5-1.mga8
libgstwebrtc1.0_0-1.18.5-1.mga8
libgsttranscoder1.0_0-1.18.5-1.mga8
libgsttranscoder-devel-1.18.5-1.mga8
gstreamer1.0-soundtouch-1.18.5-1.mga8
gstreamer1.0-rtmp-1.18.5-1.mga8
gstreamer1.0-neon-1.18.5-1.mga8
libgstbasecamerabinsrc1.0_0-1.18.5-1.mga8
libgstphotography1.0_0-1.18.5-1.mga8
gstreamer1.0-mms-1.18.5-1.mga8
gstreamer1.0-fluidsynth-1.18.5-1.mga8
libgsturidownloader1.0_0-1.18.5-1.mga8
libgstinsertbin1.0_0-1.18.5-1.mga8
gstreamer1.0-sbc-1.18.5-1.mga8
gstreamer1.0-gme-1.18.5-1.mga8
gstreamer1.0-gsm-1.18.5-1.mga8
gstreamer1.0-wildmidi-1.18.5-1.mga8
libgstisoff1.0_0-1.18.5-1.mga8
libgstplayer-gir1.0-1.18.5-1.mga8
libgstwebrtc-gir1.0-1.18.5-1.mga8
gstreamer1.0-ofa-1.18.5-1.mga8
libgstwayland1.0_0-1.18.5-1.mga8
libgstsctp1.0_0-1.18.5-1.mga8
libgstcodecs-gir1.0-1.18.5-1.mga8
libgstbadaudio-gir1.0-1.18.5-1.mga8
libgsttranscoder-gir1.0-1.18.5-1.mga8
libgirinsertbin-git1.0-1.18.5-1.mga8
gstreamer1.0-plugins-ugly-1.18.5-1.mga8
gstreamer1.0-mpeg-1.18.5-1.mga8
gstreamer1.0-sid-1.18.5-1.mga8
gstreamer1.0-a52dec-1.18.5-1.mga8
gstreamer1.0-cdio-1.18.5-1.mga8
libgstvalidate1.0_0-1.18.5-1.mga8
gstreamer1.0-devtools-1.18.5-1.mga8
gstreamer1.0-validate-scenarios-1.18.5-1.mga8
libgstvalidate-gir1.0-1.18.5-1.mga8
libgstvalidate1.0-devel-1.18.5-1.mga8
gstreamer1.0-editing-services-1.18.5-1.mga8
libges1.0-devel-1.18.5-1.mga8
gstreamer1.0-nle-1.18.5-1.mga8
gstreamer1.0-editing-services-python-1.18.5-1.mga8
libges-gir1.0-1.18.5-1.mga8
libges1.0_0-1.18.5-1.mga8
gstreamer1.0-libav-1.18.5-1.mga8
gstreamer1.0-omx-1.18.5-1.mga8
gstreamer1.0-python-1.18.5-1.mga8
libgstrtspserver1.0_0-1.18.5-1.mga8
gstreamer1.0-rtspclientsink-1.18.5-1.mga8
libgstrtspserver-gir1.0-1.18.5-1.mga8
libgstrtspserver-devel-1.18.5-1.mga8
gstreamer1.0-vaapi-1.18.5-1.mga8
Comment 4 Len Lawrence 2021-09-19 21:22:38 CEST
mga8, x86_64

Installed all the packages prior to updating.  Some were already there.
All the core rpms were installed by qarepo without issues.
MageiaUpdate issued this notice:
The following packages have to be removed for others to be upgraded:
lib64ges1.0-devel-1.18.3-1.mga8.x86_64
 (due to missing pkgconfig(gstreamer-1.0),
  due to missing devel(libgstcontroller-1.0(64bit)),
  due to missing pkgconfig(gstreamer-base-1.0),
  due to missing devel(libgstbase-1.0(64bit)),
  due to missing devel(libgstreamer-1.0(64bit)),
  due to missing pkgconfig(gstreamer-controller-1.0),
  due to missing pkgconfig(gstreamer-pbutils-1.0),
  due to missing devel(libgstvideo-1.0(64bit)),
  due to missing devel(libgstpbutils-1.0(64bit)))
lib64gstreamer-plugins-bad1.0-devel-1.18.3-1.1.mga8.tainted.x86_64
 (due to missing pkgconfig(gstreamer-1.0),
  due to missing pkgconfig(gstreamer-base-1.0),
  due to missing devel(libgstbase-1.0(64bit)),
  due to missing devel(libgstreamer-1.0(64bit)),
  due to missing devel(libgstvideo-1.0(64bit)),
  due to missing devel(libgstpbutils-1.0(64bit)),
  due to missing pkgconfig(gstreamer-sdp-1.0),
  due to missing devel(libgsttag-1.0(64bit)),
  due to missing devel(libgstsdp-1.0(64bit)),
  due to missing devel(libgstapp-1.0(64bit)),
  due to missing pkgconfig(gstreamer-video-1.0),
  due to missing devel(libgstaudio-1.0(64bit)))
lib64gstreamer-plugins-base1.0-devel-1.18.3-1.1.mga8.x86_64
 (due to missing pkgconfig(gstreamer-1.0),
  due to missing pkgconfig(gstreamer-base-1.0),
  due to missing devel(libgstbase-1.0(64bit)),
  due to missing devel(libgstreamer-1.0(64bit)))
lib64gstreamer1.0-devel-1.18.3-1.mga8.x86_64
 (due to unsatisfied lib64gst-gir1.0 == 1.18.3-1.mga8)
lib64gstrtspserver-devel-1.18.3-1.mga8.x86_64
 (due to missing pkgconfig(gstreamer-1.0),
  due to missing pkgconfig(gstreamer-base-1.0),
  due to missing devel(libgstnet-1.0(64bit)),
  due to missing devel(libgstbase-1.0(64bit)),
  due to missing devel(libgstreamer-1.0(64bit)),
  due to missing devel(libgstrtp-1.0(64bit)),
  due to missing devel(libgstsdp-1.0(64bit)),
  due to missing devel(libgstapp-1.0(64bit)))
lib64gsttranscoder-devel-1.18.3-1.1.mga8.tainted.x86_64
 (due to missing pkgconfig(gstreamer-1.0),
  due to missing devel(libgstreamer-1.0(64bit)),
  due to missing pkgconfig(gstreamer-pbutils-1.0),
  due to missing devel(libgstpbutils-1.0(64bit)))
lib64gstvalidate1.0-devel-1.18.3-1.mga8.x86_64
 (due to missing pkgconfig(gstreamer-1.0),
  due to missing devel(libgstcontroller-1.0(64bit)),
  due to missing devel(libgstbase-1.0(64bit)),
  due to missing devel(libgstcheck-1.0(64bit)),
  due to missing devel(libgstreamer-1.0(64bit)),
  due to missing devel(libgstvideo-1.0(64bit)),
  due to missing devel(libgstpbutils-1.0(64bit)))

Replied 'no' to this and carried on:
MageiaUpdate refused to install some packages but I let it run.
The following 85 packages are going to be installed:

- gstreamer1.0-a52dec-1.18.5-1.mga8.x86_64
- gstreamer1.0-aalib-1.18.5-1.mga8.x86_64
- gstreamer1.0-caca-1.18.5-1.mga8.x86_64
- gstreamer1.0-cdio-1.18.5-1.mga8.x86_64
- gstreamer1.0-cdparanoia-1.18.5-1.mga8.x86_64
- gstreamer1.0-curl-1.18.5-1.mga8.x86_64
- gstreamer1.0-dash-1.18.5-1.mga8.x86_64
- gstreamer1.0-devtools-1.18.5-1.mga8.x86_64
- gstreamer1.0-dv-1.18.5-1.mga8.x86_64
- gstreamer1.0-editing-services-1.18.5-1.mga8.x86_64
- gstreamer1.0-editing-services-python-1.18.5-1.mga8.x86_64
- gstreamer1.0-flac-1.18.5-1.mga8.x86_64
- gstreamer1.0-fluidsynth-1.18.5-1.mga8.x86_64
- gstreamer1.0-gme-1.18.5-1.mga8.x86_64
- gstreamer1.0-gsm-1.18.5-1.mga8.x86_64
- gstreamer1.0-jack-1.18.5-1.mga8.x86_64
- gstreamer1.0-ladspa-1.18.5-1.mga8.x86_64
- gstreamer1.0-lame-1.18.5-1.mga8.x86_64
- gstreamer1.0-libass-1.18.5-1.mga8.x86_64
- gstreamer1.0-libav-1.18.5-1.mga8.x86_64
- gstreamer1.0-libvisual-1.18.5-1.mga8.x86_64
- gstreamer1.0-mms-1.18.5-1.mga8.x86_64
- gstreamer1.0-mpeg-1.18.5-1.mga8.x86_64
- gstreamer1.0-mpeg2enc-1.18.5-1.mga8.x86_64
- gstreamer1.0-neon-1.18.5-1.mga8.x86_64
- gstreamer1.0-nle-1.18.5-1.mga8.x86_64
- gstreamer1.0-ofa-1.18.5-1.mga8.x86_64
- gstreamer1.0-omx-1.18.5-1.mga8.x86_64
- gstreamer1.0-plugins-bad-1.18.5-1.mga8.x86_64
- gstreamer1.0-plugins-base-1.18.5-1.mga8.x86_64
- gstreamer1.0-plugins-good-1.18.5-1.mga8.x86_64
- gstreamer1.0-plugins-ugly-1.18.5-1.mga8.x86_64
- gstreamer1.0-pulse-1.18.5-1.mga8.x86_64
- gstreamer1.0-python-1.18.5-1.mga8.x86_64
- gstreamer1.0-raw1394-1.18.5-1.mga8.x86_64
- gstreamer1.0-rtmp-1.18.5-1.mga8.x86_64
- gstreamer1.0-rtspclientsink-1.18.5-1.mga8.x86_64
- gstreamer1.0-sbc-1.18.5-1.mga8.x86_64
- gstreamer1.0-sid-1.18.5-1.mga8.x86_64
- gstreamer1.0-smoothstreaming-1.18.5-1.mga8.x86_64
- gstreamer1.0-soundtouch-1.18.5-1.mga8.x86_64
- gstreamer1.0-soup-1.18.5-1.mga8.x86_64
- gstreamer1.0-speex-1.18.5-1.mga8.x86_64
- gstreamer1.0-srtp-1.18.5-1.mga8.x86_64
- gstreamer1.0-tools-1.18.5-1.mga8.x86_64
- gstreamer1.0-transcoder-1.18.5-1.mga8.x86_64
- gstreamer1.0-twolame-1.18.5-1.mga8.x86_64
- gstreamer1.0-vaapi-1.18.5-1.mga8.x86_64
- gstreamer1.0-validate-scenarios-1.18.5-1.mga8.noarch
- gstreamer1.0-vp8-1.18.5-1.mga8.x86_64
- gstreamer1.0-wavpack-1.18.5-1.mga8.x86_64
- gstreamer1.0-wildmidi-1.18.5-1.mga8.x86_64
- lib64ges-gir1.0-1.18.5-1.mga8.x86_64
- lib64ges1.0_0-1.18.5-1.mga8.x86_64
- lib64girgstmpegts-gir1.0-1.18.5-1.mga8.x86_64
- lib64girinsertbin-git1.0-1.18.5-1.mga8.x86_64
- lib64gst-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstbadaudio-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstbadaudio1.0_0-1.18.5-1.mga8.x86_64
- lib64gstbasecamerabinsrc1.0_0-1.18.5-1.mga8.x86_64
- lib64gstcodecparsers1.0_0-1.18.5-1.mga8.x86_64
- lib64gstcodecs-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstcodecs1.0_0-1.18.5-1.mga8.x86_64
- lib64gstgl-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstgl1.0_0-1.18.5-1.mga8.x86_64
- lib64gstinsertbin1.0_0-1.18.5-1.mga8.x86_64
- lib64gstisoff1.0_0-1.18.5-1.mga8.x86_64
- lib64gstmpegts1.0_0-1.18.5-1.mga8.x86_64
- lib64gstphotography1.0_0-1.18.5-1.mga8.x86_64
- lib64gstplayer-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstplayer1.0_0-1.18.5-1.mga8.x86_64
- lib64gstreamer-plugins-base-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstreamer-plugins-base1.0_0-1.18.5-1.mga8.x86_64
- lib64gstreamer1.0_0-1.18.5-1.mga8.x86_64
- lib64gstrtspserver-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstrtspserver1.0_0-1.18.5-1.mga8.x86_64
- lib64gstsctp1.0_0-1.18.5-1.mga8.x86_64
- lib64gsttranscoder-gir1.0-1.18.5-1.mga8.x86_64
- lib64gsttranscoder1.0_0-1.18.5-1.mga8.x86_64
- lib64gsturidownloader1.0_0-1.18.5-1.mga8.x86_64
- lib64gstvalidate-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstvalidate1.0_0-1.18.5-1.mga8.x86_64
- lib64gstwayland1.0_0-1.18.5-1.mga8.x86_64
- lib64gstwebrtc-gir1.0-1.18.5-1.mga8.x86_64
- lib64gstwebrtc1.0_0-1.18.5-1.mga8.x86_64

Those updated OK.
Advice needed at this stage.

CC: (none) => tarazed25
Keywords: (none) => NEEDHELP

Comment 5 Len Lawrence 2021-09-20 18:24:20 CEST
Not advice so much as information.  Does the missing pkgconfig indicate a packaging error or something wrong with the tester's procedure?

Keywords: NEEDHELP => NEEDINFO

Comment 6 Len Lawrence 2021-09-21 15:30:46 CEST
A detailed check in /usr/lib64/pkgconfig shows that the "missing pkgconfig files" are not missing at all.  There are 33 gstreamer pc files installed for version 1.18.5 and according to the timestamps these predate the 1.18.5-1 installation.
Comment 7 Len Lawrence 2021-09-21 16:00:41 CEST
Have checked about a quarter of the packages manually so far and found that they are all 1.18.5-1 versions so it may be possible that the whole installation has succeeded.  It would be helpful to have some advice at this point.  Just carry on or what?
Comment 8 Dave Hodgins 2021-09-21 18:27:26 CEST
Removal of the devel packages should have been ok'd. Most users don't have
devel packages installed so won't see such messages. For those that do, it's
normal to have to remove them when the version associated with it is being
removed due to an update.

CC: (none) => davidwhodgins

Comment 9 Len Lawrence 2021-09-21 19:15:27 CEST
Thanks for the tip.  I shall start again.
Comment 10 Len Lawrence 2021-09-21 20:54:57 CEST
Started again on another system, same machine.
The updates installed smoothly, with devel packages removed.

A lot of packages require lib64gstreamer1.0_0:
....
gthumb
nautilus 
parole
shotwell
totem
vlc-plugin-common

$ strace -o thumb.trace gthumb /data/images/astro
$ grep gstreamer thumb.trace
openat(AT_FDCWD, "/lib64/libgstreamer-1.0.so.0", O_RDONLY|O_CLOEXEC) = 3

<many entries like this>
stat("/usr/lib64/gstreamer-1.0/libgstsubparse.so", {st_mode=S_IFREG|0755, st_size=96088, ...}) = 0
stat("/usr/lib64/gstreamer-1.0/libgstges.so", {st_mode=S_IFREG|0755, st_size=45744, ...}) = 0

.....
openat(AT_FDCWD, "/usr/lib64/gthumb/extensions/gstreamer_tools.extension", O_RDONLY) = 26
openat(AT_FDCWD, "/usr/lib64/gthumb/extensions/gstreamer_utils.extension", O_RDONLY) = 26
openat(AT_FDCWD, "/usr/lib64/gthumb/extensions/libgstreamer_tools.so", O_RDONLY|O_CLOEXEC) = 25
openat(AT_FDCWD, "/usr/lib64/gthumb/extensions/libgstreamer_utils.so", O_RDONLY|O_CLOEXEC) = 25
.....
openat(AT_FDCWD, "/usr/lib64/gstreamer-1.0/validate", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 27
.....
openat(AT_FDCWD, "/home/lcl/.cache/gstreamer-1.0/registry.x86_64.bin.tmpCFPR90", O_RDWR|O_CREAT|O_EXCL, 0600) = 24
write(24, "usr/lib64/gstreamer-1.0/libgstsh"..., 4096) = 4096
write(24, "4/gstreamer-1.0/libgstvideomixer"..., 4096) = 4096
....

$ strace -o parole.trace parole TheShipment.mkv
$ grep gstreamer parole.trace | grep -v "= 0"
openat(AT_FDCWD, "/lib64/libgstreamer-1.0.so.0", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/gstreamer-1.0.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
...
openat(AT_FDCWD, "/usr/lib64/gstreamer-1.0/libgstplayback.so", O_RDONLY|O_CLOEXEC) = 11
openat(AT_FDCWD, "/usr/lib64/gstreamer-1.0/libgstautodetect.so", O_RDONLY|O_CLOEXEC) = 13
...
$ strace -o vlc.trace vlc BadMoonRising.wav'
$ grep gstreamer vlc.trace
$
$ strace -o nautilus.trace nautilus
$ grep gstreamer nautilus.trace
openat(AT_FDCWD, "/lib64/libgstreamer-1.0.so.0", O_RDONLY|O_CLOEXEC) = 20

gstreamer is involved in some of these so it looks as if it is working but we do not know which of the other packages might be involved.
Len Lawrence 2021-09-21 20:55:11 CEST

Keywords: NEEDINFO => (none)

Len Lawrence 2021-09-23 09:04:17 CEST

Whiteboard: (none) => MGA8-64-OK

Comment 11 Thomas Andrews 2021-09-23 21:50:44 CEST
Looks good enough to me, Len. Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2021-09-29 18:16:55 CEST

Keywords: (none) => advisory

Comment 12 Mageia Robot 2021-09-29 19:24:00 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0444.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.