RedHat has issued an advisory today (April 28): https://access.redhat.com/errata/RHSA-2022:1643 This is apparently due to a bundled expat. I don't see expat BR'd in our package, so we're probably affected, in which case Mageia 8 would be also.
Whiteboard: (none) => MGA8TOOStatus comment: (none) => Possible bundled expat would need to be patched
For Mga8, xmlrpc-c-1.51.06-1.1.mga8 solves the issue. For Cauldron, there is a problem with current version of meson: """ ERROR: Got unknown keyword arguments "install" """ (see: http://pkgsubmit.mageia.org/uploads/failure/cauldron/core/release/20220429202712.ns80.duvel.2922008/log/xmlrpc-c-1.51.07-4.mga9/build.x86_64.0.20220429202806.log)
CC: (none) => nicolas.salguero
Changing NicolasS from CC to assignee, seeing you have already updated Cauldron for this. The SRPM has no registered maintainer.
Assignee: bugsquad => nicolas.salgueroCC: nicolas.salguero => (none)
For Cauldron, the problem with meson is over. Suggested advisory: ======================== The updated packages fix a security vulnerability: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25235 https://access.redhat.com/errata/RHSA-2022:1643 ======================== Updated packages in core/updates_testing: ======================== lib(64)xmlrpc-c3-1.51.06-1.1.mga8 lib(64)xmlrpc-c-devel-1.51.06-1.1.mga8 xmlrpc-c-1.51.06-1.1.mga8 from SRPM: xmlrpc-c-1.51.06-1.1.mga8.src.rpm
Status comment: Possible bundled expat would need to be patched => (none)CC: (none) => nicolas.salgueroCVE: (none) => CVE-2022-25235Status: NEW => ASSIGNEDVersion: Cauldron => 8Assignee: nicolas.salguero => qa-bugsWhiteboard: MGA8TOO => (none)
MGA8-64 Plasma on Lenovo B50 in Dutch No installation issues Mcc says: "Programming library for writing an XML-RPC server or client in C or C++" So I will OK it on clean install just as for other deveopers's stuff. But in case someone would like to try her/his hand on it, I found way over my head) https://www.tutorialspoint.com/xml-rpc/xml_rpc_examples.htm
CC: (none) => herman.viaeneWhiteboard: (none) => MGA8-64-OK
Nothing that I can use. Every time I start to think I could consider myself a skilled used, a series of these development packages comes along for QA approval to prove how little I actually know. Validating. Advisory in Comment 3.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
Keywords: (none) => advisoryCC: (none) => davidwhodgins
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0183.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED