Suggested advisory:
========================

The updated packages fix a security vulnerability:

Integer Overflow in LibKSBA. (CVE-2022-3515)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3515
https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html
========================

Updated packages in core/updates_testing:
========================
lib(64)ksba8-1.5.0-1.1.mga8
lib(64)ksba-devel-1.5.0-1.1.mga8

from SRPM:
libksba-1.5.0-1.1.mga8.src.rpm

Status: NEW => ASSIGNED
Version: Cauldron => 8
Assignee: bugsquad => qa-bugs
Whiteboard: MGA8TOO => (none)

Debian has issued an advisory for this on October 17:
https://www.debian.org/security/2022/dsa-5255

The following 4 packages are going to be installed:

- lib64gpg-error-devel-1.41-1.mga8.x86_64
- lib64ksba-devel-1.5.0-1.1.mga8.x86_64
- lib64ksba8-1.5.0-1.1.mga8.x86_64
- multiarch-utils-1.0.14-3.mga8.noarch

672KB of additional disk space will be used.


$ gpgconf --show-version

said 1.5.0

Created Cert
$ gpgsm --gen-key > x.pem


it worked.

That's my best guess on testing the library

CC: (none) => brtians1

Looks like you have a good start. 

Searching previous updates, there's a procedure at https://bugs.mageia.org/show_bug.cgi?id=11306#c3 (substitute "gpg2" for "gpg" in the test)

CC: (none) => andrewsfarm

sorry no gpg2 in repo.

gpg2 is a command name.  The package is gnupg2.

yep gpg2 is installed.  Running into issues and don't have time to deal with them.  Someone else will need to validate this one.

Validating based on comment 3. lib64ksba8 is used with the gpgsm command, not
with the gpg or gpg2 commands or with openpgp (which thunderbird uses).

gpgsm requires converting the gpg keys from the format used in pubring.gpg to
the format used in pubring.kbx

I don't know if any other Mageia packages use gpgsm. None of the ones I'm
familiar with use it in my usage or testing.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => davidwhodgins, sysadmin-bugs
Keywords: (none) => validated_update

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0404.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED