Fedora has issued an advisory today (September 16): https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EDUT2V62V2XF2IT5TJFPB6P3EQ6X5VLL/ Mageia 8 is also affected.
Whiteboard: (none) => MGA8TOOStatus comment: (none) => Patch available from Fedora
Assigning to the registered maintainer, mjack, but CC'ing all packagers collectively because I haven't seen the maintainer in years. Jack, I hope everything is well with you!
CC: (none) => marja11, pkg-bugsAssignee: bugsquad => jackal.j
Suggested advisory: ======================== The updated packages fix a security vulnerability: cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read. (CVE-2022-40320) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40320 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EDUT2V62V2XF2IT5TJFPB6P3EQ6X5VLL/ ======================== Updated packages in core/updates_testing: ======================== libconfuse-3.3-1.1.mga8 lib(64)confuse2-3.3-1.1.mga8 lib(64)confuse-devel-3.3-1.1.mga8 from SRPM: libconfuse-3.3-1.1.mga8.src.rpm
Assignee: jackal.j => qa-bugsWhiteboard: MGA8TOO => (none)Status comment: Patch available from Fedora => (none)Version: Cauldron => 8Status: NEW => ASSIGNEDCVE: (none) => CVE-2022-40320Source RPM: libconfuse-3.3-2.mga9.src.rpm => libconfuse-3.3-1.mga8.src.rpmCC: (none) => nicolas.salguero
mga8, x11 Installed the libraries then updated them from testing. $ rpm -q lib64confuse2 lib64confuse2-3.3-1.1.mga8 There is a POC for CVE-2022-40320 which is really out of our scope. The cfgtest files in examples do not run (against the poc file). tilda is a drop down terminal without decorations. $ strace -o tilda.trace tilda <modified various preferences - centred the drop down window after changing its size and transparency via the menus> $ exit $ grep confuse tilda.trace openat(AT_FDCWD, "/lib64/libconfuse.so.2", O_RDONLY|O_CLOEXEC) = 3 That indicates use of lib64confuse2 I think. That is enough for an OK.
Whiteboard: (none) => MGA8-64-OKCC: (none) => tarazed25
Validating. Advisory in Comment 2.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0387.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED