Bug 29670 - wireshark new release 3.4.10 fixes security issues
Summary: wireshark new release 3.4.10 fixes security issues
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, has_procedure, validated_update
Depends on:
Blocks:
 
Reported: 2021-11-18 22:06 CET by David Walser
Modified: 2021-11-20 20:32 CET (History)
4 users (show)

See Also:
Source RPM: wireshark-3.4.7-1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2021-11-18 22:06:46 CET
Upstream has released new versions on November 17:
https://www.wireshark.org/news/20211117.html

Updated package uploaded for Mageia 8.

Advisory:
========================

Updated wireshark packages fix security vulnerabilities:

IPPUSB dissector crash (CVE-2021-39920).

Modbus dissector crash (CVE-2021-39921).

C12.22 dissector crash (CVE-2021-39922).

PNRP dissector large loop (wnpa-sec-2021-11).

Bluetooth DHT dissector large loop (CVE-2021-39924).

Bluetooth SDP dissector crash (CVE-2021-39925).

Bluetooth HCI_ISO dissector crash (CVE-2021-39926).

IEEE 802.11 dissector crash (CVE-2021-39928).

Bluetooth DHT dissector crash (CVE-2021-39929).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39921
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39922
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39924
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39925
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39926
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39928
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39929
https://www.wireshark.org/security/wnpa-sec-2021-07
https://www.wireshark.org/security/wnpa-sec-2021-08
https://www.wireshark.org/security/wnpa-sec-2021-09
https://www.wireshark.org/security/wnpa-sec-2021-10
https://www.wireshark.org/security/wnpa-sec-2021-11
https://www.wireshark.org/security/wnpa-sec-2021-12
https://www.wireshark.org/security/wnpa-sec-2021-13
https://www.wireshark.org/security/wnpa-sec-2021-14
https://www.wireshark.org/security/wnpa-sec-2021-15
https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html
https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html
https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html
https://www.wireshark.org/news/20210825.html
https://www.wireshark.org/news/20211006.html
https://www.wireshark.org/news/20211117.html
========================

Updated packages in core/updates_testing:
========================
wireshark-3.4.10-1.mga8
libwireshark-devel-3.4.10-1.mga8
wireshark-tools-3.4.10-1.mga8
libwiretap11-3.4.10-1.mga8
tshark-3.4.10-1.mga8
dumpcap-3.4.10-1.mga8
rawshark-3.4.10-1.mga8
libwsutil12-3.4.10-1.mga8
libwireshark14-3.4.10-1.mga8

from wireshark-3.4.10-1.mga8.src.rpm
Comment 1 David Walser 2021-11-18 22:07:03 CET
Testing procedure:
https://wiki.mageia.org/en/QA_procedure:Wireshark

Keywords: (none) => has_procedure

Comment 2 Herman Viaene 2021-11-20 11:40:02 CET
MGA8-64 Plasma on Lenovo B50
No installation issues
Followed my previous bug 29088 to avoid the niggles encountered there.
$ wireshark -n -w wiresharktest.pcapng 
File saved OK
$ tshark -nr wiresharktest.pcapng | more                              
    1 0.000000000 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.74? Tell 192.168.2.15
    2 0.921634806 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.74? Tell 192.168.2.15
    3 1.945619265 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.74? Tell 192.168.2.15
    4 2.969846276 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.74? Tell 192.168.2.15
    5 2.969846331 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.80? Tell 192.168.2.15
    6 3.993921220 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.74? Tell 192.168.2.15
    7 3.993921273 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.80? Tell 192.168.2.15
    8 4.915517888 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.74? Tell 192.168.2.15
    9 4.915517939 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.80? Tell 192.168.2.15
   10 5.939663393 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.80? Tell 192.168.2.15
   11 5.939663442 34:31:c4:80:a9:b4 → ff:ff:ff:ff:ff:ff ARP 56 Who has 192.168.2.70? Tell 192.168.2.15
   12 6.120250287  192.168.2.5 → 192.168.2.1  DNS 73 Standard query 0x9b8d A www.google.be
   13 6.120838037  192.168.2.5 → 192.168.2.1  DNS 73 Standard query 0xa8ba AAAA www.google.be
   14 6.130226109  192.168.2.5 → 192.168.2.1  DNS 75 Standard query 0x3014 A apis.google.com
etc.....
$ editcap -r wiresharktest.pcapng wiresharktest50 1-50
generated the smaller file OK.
$ mergecap -v -w wiresharkmerged wiresharktest.pcapng wiresharktest50 
mergecap: wiresharktest.pcapng is type Wireshark/... - pcapng.
mergecap: wiresharktest50 is type Wireshark/... - pcapng.
mergecap: selected frame_type Ethernet (ether)
mergecap: ready to merge records
Record: 1
Record: 2
Record: 3
and so on till
Record: 5886
Record: 5887
mergecap: merging complete
$ randpkt -b 500 -t dns wireshark_dns.pcap
$ capinfos wiresharktest50
File name:           wiresharktest50
File type:           Wireshark/... - pcapng
File encapsulation:  Ethernet
File timestamp precision:  nanoseconds (9)
Packet size limit:   file hdr: (not set)
Number of packets:   50
File size:           19kB
Data size:           17kB
Capture duration:    6,248426049 seconds
First packet time:   2021-11-20 11:27:06,332680483
Last packet time:    2021-11-20 11:27:12,581106532
Data byte rate:      2.737 bytes/s
Data bit rate:       21kbps
Average packet size: 342,12 bytes
Average packet rate: 8 packets/s
SHA256:              76f89172c8fdc94ac4fa0e2093d9ad27f55a5ec8b2522cabf53e8e5cf4d18fac
RIPEMD160:           1dc5d6869009c462d31ca2ccc9b2229c21ea286e
SHA1:                c513860012d2e518ab75411920593ead79c3a288
Strict time order:   True
Capture hardware:    Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz (with SSE4.2)
Capture oper-sys:    Linux 5.10.78-server-1.mga8
Capture application: Dumpcap (Wireshark) 3.4.10 (Git commit 733b3a137c2b)
Number of interfaces in file: 1
Interface #0 info:
                     Name = wlp9s0
                     Encapsulation = Ethernet (1 - ether)
                     Capture length = 262144
                     Time precision = nanoseconds (9)
                     Time ticks per second = 1000000000
                     Time resolution = 0x09
                     Operating system = Linux 5.10.78-server-1.mga8
                     Number of stat entries = 0
                     Number of packets = 50

Looks good to go.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA8-64-OK

Comment 3 Thomas Andrews 2021-11-20 17:59:05 CET
Validating. Advisory in Comment 0.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2021-11-20 18:33:44 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 4 Mageia Robot 2021-11-20 20:32:27 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0518.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.