Bug 29985 - expat new security issues CVE-2022-23852 and CVE-2022-23990
Summary: expat new security issues CVE-2022-23852 and CVE-2022-23990
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-02-01 17:59 CET by David Walser
Modified: 2022-02-03 21:30 CET (History)
4 users (show)

See Also:
Source RPM: expat-2.2.10-1.1.mga8.src.rpm
CVE: CVE-2022-23852, CVE-2022-23990
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-02-01 17:59:22 CET 
Debian-LTS has issued an advisory on January 30:
https://www.debian.org/lts/security/2022/dla-2904

The issues are fixed upstream in 2.4.4.

Mageia 8 is also affected.
David Walser 2022-02-01 17:59:38 CET

Status comment: (none) => Fixed upstream in 2.4.4
Whiteboard: (none) => MGA8TOO
CC: (none) => nicolas.salguero

Comment 1 Lewis Smith 2022-02-01 20:15:23 CET 
'expat' is committed by different people, so assigning this update globally.

Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Salguero 2022-02-02 10:44:11 CET 
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23852
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23990
https://www.debian.org/lts/security/2022/dla-2904
========================

Updated packages in core/updates_testing:
========================
expat-2.2.10-1.2.mga8
lib(64)expat1-2.2.10-1.2.mga8
lib(64)expat-devel-2.2.10-1.2.mga8

from SRPM:
expat-2.2.10-1.2.mga8.src.rpm

Version: Cauldron => 8
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA8TOO => (none)
Source RPM: expat-2.4.3-1.mga9.src.rpm => expat-2.2.10-1.1.mga8.src.rpm
Status comment: Fixed upstream in 2.4.4 => (none)
Status: NEW => ASSIGNED
CVE: (none) => CVE-2022-23852, CVE-2022-23990

Comment 3 Thomas Andrews 2022-02-02 21:52:18 CET 
Updated all three packages in VirtualBox, with no installation issues.

Consulted with https://wiki.mageia.org/en/QA_procedure:Expat for testing procedure:

$ python testexpat.py
Tested OK

$ xmlwf /etc/xml/catalog
$ xmlwf /etc/passwd
/etc/passwd:1:16: not well-formed (invalid token)

It passes the test. Giving it the OK and validating. Advisory in Comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: (none) => MGA8-64-OK

Dave Hodgins 2022-02-03 20:43:04 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 4 Mageia Robot 2022-02-03 21:30:45 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0048.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.