Bug 29537 - python-mpmath new security issue CVE-2021-29063
Summary: python-mpmath new security issue CVE-2021-29063
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-10-07 21:41 CEST by David Walser
Modified: 2021-10-13 21:41 CEST (History)
6 users (show)

See Also:
Source RPM: python-mpmath-1.2.1-1.mga9.src.rpm
CVE:
Status comment:


Attachments

David Walser 2021-10-07 21:41:57 CEST

Status comment: (none) => Patch available from Fedora
Whiteboard: (none) => MGA8TOO

Comment 1 Nicolas Lécureuil 2021-10-08 19:46:31 CEST
fix pushed in cauldron.

Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8
CC: (none) => mageia

Comment 2 Nicolas Lécureuil 2021-10-08 19:51:01 CEST
pushed in mga8:

src:
    - python-mpmath-1.1.0-5.1.mga8

Status comment: Patch available from Fedora => (none)
Assignee: bugsquad => qa-bugs

Comment 3 David Walser 2021-10-08 20:15:14 CEST
RPM:
python3-mpmath-1.1.0-5.1.mga8
Comment 4 Herman Viaene 2021-10-12 15:52:48 CEST
MGA8-64 Plasma on Lenovo B50
Installs OK, but I finf it kind of weird the this draws in 39 other packages of which a substantial part (guess 15 or so) are perl packages.
If this is what to be expected I will agree on OK on clean install.

CC: (none) => herman.viaene

Comment 5 Len Lawrence 2021-10-12 17:41:13 CEST
Followed one of the links but not sure what the problem is with this package or even if there is one.

Installed the core package on x86_64 - no dependencies.  Must already be installed.
$ urpmq --requires-recursive python3-mpmath | uniq | wc -l
367
$ urpmq --requires python3-mpmath | uniq | wc -l
1
$ urpmq --whatrequires python3-mpmath | uniq
python3-mpmath
python3-sympy
xmds
$ sudo urpmi xmds
Pulls in python3-cheetah and python3-lxml.  No documentation for xmds beyond a host of example files in /usr/share/doc.  There is a command xmsd2.
usage: xmds2 [options] fileToBeParsed
$ xmds2 -o xmds.test /usr/share/doc/xmds/examples/photodetector.xmds
xmds2 version 3.0.0 "Release the Kraken" (r3072)
Copyright 2000-2019 Graham Dennis, Joseph Hope, Mattias Johnsson
                    and the xmds team
Reconfiguring xmds2 (updated config script)...

Configuring for single-process scripts...
Checking for 'g++' (C++ compiler)        : /usr/bin/g++ 
Checking whether the compiler works      : yes 
Checking that we have a C++ compiler     : yes 
Checking whether we are cross-compiling  : no 
Checking whether we can link to only static libraries : yes 
Trying to make compiler optimise for this machine     : yes 
Trying to make compiler tune for this machine         : yes 
Checking for compiler flags -O3                       : yes 
Checking for compiler flags -ffast-math               : yes 
Checking for compiler flags -funroll-all-loops        : yes 
Checking for compiler flags -fomit-frame-pointer      : yes 
Checking for compiler flags -falign-loops             : yes 
Checking for compiler flags -fstrict-aliasing         : yes 
Checking for compiler flags -momit-leaf-frame-pointer : yes 
Checking for cautious math flags                      : yes 
Checking for Autovectorisation                        : yes 
Checking for OpenMP                                   : yes 
Checking for pthreads                                 : yes 
Checking for compiler debug flags                     : yes 
Checking for srandomdev                               : yes 
Checking for /dev/urandom                             : yes 
Checking for program 'h5cc'                           : not found 
Checking for libxmds (static library)                 : no (will try dynamic library instead) 
Checking for libxmds (dynamic library)                : no (it's optional anyway) 
Checking for Intel's Vector Math Library (static library) : no (will try dynamic library instead) 
Checking for Intel's Vector Math Library (dynamic library) : no (it's optional anyway) 
Checking safer dSFMT compile flags                         : yes 
Checking for Intel's Math Kernel Library (static library)  : no (will try dynamic library instead) 
Checking for Intel's Math Kernel Library (dynamic library) : no (it's optional anyway) 
Checking for ATLAS's CBLAS. (static library)               : no (will try dynamic library instead) 
Checking for ATLAS's CBLAS. (dynamic library)              : no (it's optional anyway) 
Checking for GSL's CBLAS (static library)                  : no (will try dynamic library instead) 
Checking for GSL's CBLAS (dynamic library)                 : no (it's optional anyway) 
Checking for GSL (static library)                          : no (will try dynamic library instead) 
Checking for GSL (dynamic library)                         : no (it's optional anyway) 
Checking for FFTW3 (static library)                        : no (will try dynamic library instead) 
Checking for FFTW3 (dynamic library)                       : Couldn't find FFTW3.  Please install. 
Checking for single-precision FFTW3 (static library)       : no (will try dynamic library instead) 
Checking for single-precision FFTW3 (dynamic library)      : no (it's optional anyway) 

Configuring for MPI scripts...
Checking for program 'mpic++'                              : not found 
Checking for program 'mpiicpc'                             : not found 
MPI not found. No scripts using MPI can be compiled on this system.
('Config log saved to ', '/home/lcl/.xmds/waf_configure/config.log')
Generating source code...
... done
Compiling simulation...
This script requires libraries or features that xmds2 could not find.
Make sure these requirements are installed and then run 'xmds2 --reconfigure'.
The missing 1 feature(s) were: hdf5.

FATAL ERROR: Failed to compile. Check warnings and errors. The most important will be first.

This looks as if it needs a special development environment so the best thing to do is test xdms against the updated package using the same test file.  This one generates a C++ file xmds.test.cc.  Renaming this to xmds_b.cc.
Second part later.

CC: (none) => tarazed25

Comment 6 Len Lawrence 2021-10-12 17:44:22 CEST
Need to note that the application is looking for libxdms but does not find it and says that it is optional.  So maybe xdms2 is not that useful as a test bed.
Comment 7 Len Lawrence 2021-10-12 18:14:07 CEST
/usr/share/doc/xmds/README has a link pointing to the background for xdms.

python3-sympy pulls in python3-pyglet.
/usr/share/doc/python3-sympy/PKG-INFO:
Name: sympy
Version: 1.7.1
Summary: Computer algebra system (CAS) in Python
Home-page: https://sympy.org
Author: SymPy development team
Author-email: sympy@googlegroups.com
License: BSD
Description: # SymPy
        
        A Python library for symbolic mathematics.

Out of my league.

Updated the one rpm.
$ xmds2 -o xmds_a /usr/share/doc/xmds/examples/photodetector.xmds
xmds2 version 3.0.0 "Release the Kraken" (r3072)
Copyright 2000-2019 Graham Dennis, Joseph Hope, Mattias Johnsson
                    and the xmds team
Generating source code...
... done
Compiling simulation...
This script requires libraries or features that xmds2 could not find.
Make sure these requirements are installed and then run 'xmds2 --reconfigure'.
The missing 1 feature(s) were: hdf5.

FATAL ERROR: Failed to compile. Check warnings and errors. The most important will be first.

Much less verbose but the same result.  The differences between the two code files were trivial, related to the renaming of the first result.
That at least seems to demonstrate no regression but may not be a reliable test given that the python library is not required.

Leaving it at that and assigning a tentative OK.

Whiteboard: (none) => MGA8-64-OK

Comment 8 Len Lawrence 2021-10-12 18:23:43 CEST
Oops - forgot to perform a trace.
$ grep mpmath xmds.trace
.......
openat(AT_FDCWD, "/usr/lib/python3.8/site-packages/mpmath/__pycache__/__init__.cpython-38.pyc", O_RDONLY|O_CLOEXEC) = 3
s
........
openat(AT_FDCWD, "/usr/lib/python3.8/site-packages/mpmath/functions", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3

Numerous references with openat and a status of 3 as well as dozens of stat calls.
Reinforces the OK.
Comment 9 Thomas Andrews 2021-10-13 04:06:09 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2021-10-13 20:39:00 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 10 Mageia Robot 2021-10-13 21:41:34 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0479.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.