Bug 29803 - calibre new security issue CVE-2021-44686
Summary: calibre new security issue CVE-2021-44686
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-12-22 16:57 CET by David Walser
Modified: 2021-12-30 17:43 CET (History)
6 users (show)

See Also:
Source RPM: calibre-4.23.0-7.mga9.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2021-12-22 16:57:52 CET 
Fedora has issued an advisory today (December 22):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/W7QKFPYJ23KG6WJ5NIYAM4N2NWZCLQGL/

The issue is fixed upstream in 5.32.0.

Mageia 8 is also affected.
David Walser 2021-12-22 16:58:06 CET

Status comment: (none) => Patch available from Fedora
Whiteboard: (none) => MGA8TOO

Comment 1 Lewis Smith 2021-12-22 19:36:46 CET 
Seems best to assign this to Stig, official maintainer even though you have not touched it for ages (Update to version 4.23.0).

Assignee: bugsquad => smelror

Comment 2 Nicolas Lécureuil 2021-12-27 00:42:23 CET 
Fix pushed in mga 8/9

src:
    - calibre-4.23.0-3.1.mga8

CC: (none) => mageia, smelror
Assignee: smelror => qa-bugs
Status comment: Patch available from Fedora => (none)
Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)

Comment 3 Len Lawrence 2021-12-27 23:50:40 CET 
mga8, x64
Went ahead with this on the assumption that only one update file is involved.Calibre already installed and database established in ~/'Calibre Library'.
Clean update to calibre-4.23.0-3.1.mga8.
Launched the application from system menus and loaded an existing epub book from the library and perused it.  Did the same for a PDF.  Converted an external PDF to standard epub format and opened that in the Viewer.  Used the "get books" facility to search on Entanglement and download a specific choice in epub format from archive.org but that failed.  Found the same book via Project Gutenberg and downloaded it as a PDF.  It could be read OK, unintelligible for the layman.  Examined tags for various items in the library.  Closed down then restarted from the cli.  The new book was there.  Selected and deleted the new book.  It was definitely gone on the next run.

No regressions so it can be sent on.

CC: (none) => tarazed25
Whiteboard: (none) => MGA8-64-OK

Comment 4 Thomas Andrews 2021-12-27 23:58:18 CET 
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2021-12-30 03:50:03 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 5 Mageia Robot 2021-12-30 17:43:05 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0593.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.