Bug 30137 - freecad new security issue CVE-2021-45844
Summary: freecad new security issue CVE-2021-45844
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
: 28749 (view as bug list)
Depends on:
Blocks:
 
Reported: 2022-03-08 16:27 CET by David Walser
Modified: 2022-09-16 21:41 CEST (History)
7 users (show)

See Also:
Source RPM: freecad-0.18.6-1.2.mga8.src.rpm
CVE: CVE-2021-45844
Status comment:


Attachments

Description David Walser 2022-03-08 16:27:42 CET
Debian-LTS has issued an advisory on March 7:
https://www.debian.org/lts/security/2022/dla-2934

The issue is fixed upstream in 0.19.4.
David Walser 2022-03-08 16:28:05 CET

Status comment: (none) => Fixed upstream in 0.19.4
See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=28749
CC: (none) => smelror

Morgan Leijström 2022-03-08 17:49:12 CET

CC: (none) => fri

Comment 1 Morgan Leijström 2022-03-08 18:05:06 CET
Setting to registered packager

The update is also good for other reasons

Assignee: bugsquad => yann.cantin

Comment 2 David Walser 2022-08-19 17:31:57 CEST
Debian-LTS has issued another advisory for this on August 18:
https://www.debian.org/lts/security/2022/dla-3076
Comment 3 Morgan Leijström 2022-08-25 13:07:41 CEST
Current stable version is 0.20
Flatpak provides 0.20.1

No response from Yann, so I promote smelror as asignee, please reset if you are not interested.
I see David G also have packaged it in the past.
I will do a quick test when packaged.

Assignee: yann.cantin => smelror
CC: (none) => geiger.david68210, yann.cantin

Comment 4 Morgan Leijström 2022-08-25 13:12:21 CEST
*** Bug 28749 has been marked as a duplicate of this bug. ***
Comment 5 Nicolas Salguero 2022-09-12 11:09:54 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename. (CVE-2021-45844)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45844
https://www.debian.org/lts/security/2022/dla-2934
https://www.debian.org/lts/security/2022/dla-3076
========================

Updated packages in core/updates_testing:
========================
freecad-0.18.6-1.3.mga8
freecad-data-0.18.6-1.3.mga8

from SRPM:
freecad-0.18.6-1.3.mga8.src.rpm

Status: NEW => ASSIGNED
CVE: (none) => CVE-2021-45844
Assignee: smelror => qa-bugs
Status comment: Fixed upstream in 0.19.4 => (none)
CC: (none) => nicolas.salguero

Comment 6 Morgan Leijström 2022-09-12 13:23:08 CEST
Quick test OK

Is there build/dep problems to package version 0.20.1 ?
It is the current stable.

There is no use putting work in packaging and QA if users anyway use alternative methods to easily install and update current version...

20.0.1 is available as both Appimage and flatpak.
I have tested both runs om mga8.

And their dev version is also available as flatpak, BTW.
Comment 7 David Walser 2022-09-12 14:32:47 CEST
Mageia 8 is a stable release.  We'll patch things where we can.
Comment 8 Morgan Leijström 2022-09-12 15:35:09 CEST
Yes... there are small incompatibilities. *)
Two sides of this coin: Not surprise our users with new version, and the other is users want to be compatible with other peoples new creations, and tutorials.

*) such as
https://tracker.freecadweb.org/view.php?id=4448
https://forum.freecadweb.org/viewtopic.php?t=38928


Actually in real life, in cases like this it is much better to update big version steps in a current Mageia - as users then easily can downgrade back.

When we force them new program version when they upgrade to next Mageia, they can not as easily go back!


Our 0.18.6 is two main version steps behind *stable*
https://wiki.freecadweb.org/Release_notes_0.19
https://wiki.freecadweb.org/Release_notes_0.20

*If* we had more manpower we ought to push current software versions to backport, like we actually do for KiCAD.

But given low resources, I ponder if we should generally stop packaging big leaf packages like freecad, kicad... and other such progs that our users anyways can  install any version they like by other methods we provide anyway.  Also Nextcloud comes to mind...

- Spare resources to keep system in shape, underlying packages, and that the subystems like flatpak are up to date.

But should be discussed at another channel...

CC: (none) => sysadmin-bugs
Whiteboard: (none) => MGA8-64-OK
Keywords: (none) => validated_update

Comment 9 David Walser 2022-09-14 22:49:24 CEST
For future reference, CVE-2021-45845 was also fixed in 0.19.4.  0.18.x (and thus Mageia 8) was not affected:
https://www.debian.org/security/2022/dsa-5229
Dave Hodgins 2022-09-16 19:54:34 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 10 Mageia Robot 2022-09-16 21:41:22 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0325.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.