Bug 31057 - expat new security issue CVE-2022-43680
Summary: expat new security issue CVE-2022-43680
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-10-31 15:11 CET by David Walser
Modified: 2022-11-04 22:17 CET (History)
5 users (show)

See Also:
Source RPM: expat-2.2.10-1.5.mga8.src.rpm
CVE: CVE-2022-43680
Status comment:

Attachments
python script (268 bytes, text/plain)
2022-11-03 11:17 CET, Herman Viaene 		Details
testdata (693 bytes, text/xml)
2022-11-03 11:17 CET, Herman Viaene 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-10-31 15:11:35 CET 
Debian has issued an advisory on October 30:
https://www.debian.org/security/2022/dsa-5266

The issue is fixed upstream in 2.5.0.

We may have to patch Firefox and Thunderbird too (can wait until next update).

Mageia 8 is also affected.
David Walser 2022-10-31 15:50:59 CET

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 2.5.0
Assignee: bugsquad => nicolas.salguero

Comment 1 Nicolas Salguero 2022-11-02 15:02:46 CET 
Suggested advisory:
========================

The updated packages fix a security vulnerability:

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680
https://www.debian.org/security/2022/dsa-5266
========================

Updated packages in core/updates_testing:
========================
expat-2.2.10-1.6.mga8
lib(64)expat1-2.2.10-1.6.mga8
lib(64)expat-devel-2.2.10-1.6.mga8

from SRPM:
expat-2.2.10-1.6.mga8.src.rpm

Status comment: Fixed upstream in 2.5.0 => (none)
Status: NEW => ASSIGNED
Whiteboard: MGA8TOO => (none)
CC: (none) => nicolas.salguero
CVE: (none) => CVE-2022-43680
Assignee: nicolas.salguero => qa-bugs
Version: Cauldron => 8
Source RPM: expat-2.4.9-1.mga9.src.rpm => expat-2.2.10-1.5.mga8.src.rpm

Comment 2 Herman Viaene 2022-11-03 11:16:22 CET 
MGA8-64 MATE on Acer Aspire 5253
No installation issues.
Followed wiki-procedure (I will upload the files used)
$ cd Documents/expat/
$ ls
testdata.xml  testexpat.py
$ python testexpat.py
Tested OK
and to be sure
$ python3 testexpat.py
Tested OK
And as in the wiki
$ xmlwf /etc/xml/catalog
$ xmlwf /etc/passwd
/etc/passwd:1:16: not well-formed (invalid token)
Looks good to me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA8-64-OK

Comment 3 Herman Viaene 2022-11-03 11:17:07 CET 
Created attachment 13471 [details]
python script
Comment 4 Herman Viaene 2022-11-03 11:17:40 CET 
Created attachment 13472 [details]
testdata
Comment 5 Thomas Andrews 2022-11-03 12:45:36 CET 
Validating. Advisory in Comment 2.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2022-11-04 16:50:59 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 6 Mageia Robot 2022-11-04 22:17:20 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0409.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.