Bug 29834 - libgda, libgda5.0 new security issue CVE-2021-39359
Summary: libgda, libgda5.0 new security issue CVE-2021-39359
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-12-31 19:28 CET by David Walser
Modified: 2022-01-03 08:37 CET (History)
4 users (show)

See Also:
Source RPM: libgda5.0-5.2.9-3.mga8.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2021-12-31 19:28:44 CET 
Fedora has issued an advisory today (December 31):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HRPPP47WRCAPAEJGRMEKYYJZBQCYXTLQ/

Mageia 8 is also affected.
David Walser 2021-12-31 19:28:56 CET

Status comment: (none) => Patch available from Fedora
Whiteboard: (none) => MGA8TOO

Comment 1 Lewis Smith 2021-12-31 19:46:52 CET 
This is wally's baby.

Assignee: bugsquad => jani.valimaa

Comment 2 Jani Välimaa 2021-12-31 21:51:00 CET 
libgda doesn't exist in mga8. libgda and libga5.0 fixed in cauldron.

Updated cauldron pkgs:
libgda-6.0.0-3.mga9
libgda5.0-5.2.10-2.mga9

Version: Cauldron => 8
Source RPM: libgda-6.0.0-2.mga9.src.rpm, libgda5.0-5.2.9-3.mga8.src.rpm => libgda5.0-5.2.9-3.mga8.src.rpm
Whiteboard: MGA8TOO => (none)

Comment 3 Jani Välimaa 2021-12-31 21:57:19 CET 
Pushed fixed libgda5.0-5.2.9-3.1.mga8 to mga8 core/updates_testing. Please test.

SRPMS:
libgda5.0-5.2.9-3.1.mga8

RPMS:
libgda5.0-5.2.9-3.1.mga8
lib(64)gda5.0_4-5.2.9-3.1.mga8
lib(64)gda5.0-devel-5.2.9-3.1.mga8
lib(64)gda-gir5.0-5.2.9-3.1.mga8
lib(64)gdaui-gir5.0-5.2.9-3.1.mga8
libgda5.0-postgres-5.2.9-3.1.mga8
libgda5.0-mysql-5.2.9-3.1.mga8
libgda5.0-bdb-5.2.9-3.1.mga8
libgda5.0-sqlite-5.2.9-3.1.mga8

Assignee: jani.valimaa => qa-bugs
CC: (none) => jani.valimaa

David Walser 2021-12-31 22:16:11 CET

Status comment: Patch available from Fedora => (none)

Comment 4 Thomas Andrews 2022-01-02 20:53:52 CET 
No previous updates, but a recursive search with urpmq revealed that the Gnome app Planner requires libgda5.0, or at least one of its dependencies. Checked my Gnome VirtualBox guest, and found that Planner was already installed, so used qarepo to update. No installation issues.

Ran strace on planner, and found several references to libgda-related files. No obvious issues noted, though for the record I don't recall ever using the app.

Then I took a look at the file list in drakrpm for libgda5.0, and found a bin for "gdaui-demo-5.0" Ran that in a terminal, and after several warnings about Gtk theme parsing errors regarding depreciated button borders, a small gui came up with a list of demos. Double-clicked on some to run them, and no issues were noted.

Looks like this one is OK. Validating.

Whiteboard: (none) => MGA8-64-OK
Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2022-01-03 03:02:50 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 5 Mageia Robot 2022-01-03 08:37:48 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0005.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.