Bug 31075 - apache-ivy new security issues CVE-2022-3786[56]
Summary: apache-ivy new security issues CVE-2022-3786[56]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-11-04 17:07 CET by David Walser
Modified: 2023-07-07 07:56 CEST (History)
5 users (show)

See Also:
Source RPM: apache-ivy-2.5.0-3.mga9.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-11-04 17:07:20 CET 
Apache has issued advisories on November 4:
https://www.openwall.com/lists/oss-security/2022/11/04/2
https://www.openwall.com/lists/oss-security/2022/11/04/3

The issues are fixed upstream in 2.5.1.

Mageia 8 is also affected.
David Walser 2022-11-04 17:09:23 CET

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 2.5.1

Comment 1 David GEIGER 2023-07-01 07:08:39 CEST 
patch added for both mga8 and cauldron!


Packages in 9/Core/Updates_testing:
======================
apache-ivy-javadoc-2.5.0-4.mga9.noarch.rpm
apache-ivy-2.5.0-4.mga9.noarch.rpm

Packages in 8/Core/Updates_testing:
======================
apache-ivy-2.5.0-1.1.mga8.noarch.rpm
apache-ivy-javadoc-2.5.0-1.1.mga8.noarch.rpm


From SRPMS:
apache-ivy-2.5.0-4.mga9.src.rpm
apache-ivy-2.5.0-1.1.mga8.src.rpm

Assignee: java => qa-bugs
CC: (none) => geiger.david68210
Status comment: Fixed upstream in 2.5.1 => (none)

Comment 2 David GEIGER 2023-07-02 15:44:45 CEST 
apache-ivy moved in Core/Release for cauldron, so fixed for it!

Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)

Comment 3 Herman Viaene 2023-07-03 16:00:44 CEST 
MGA8-64 MATE on Acer Aspire 5253
No installation issues.
Developer's stuff, does not harm anything else (httpd starts, localhost 'It works').

CC: (none) => herman.viaene
Whiteboard: (none) => MGA8-64-OK

Comment 4 David Walser 2023-07-04 00:04:42 CEST 
It doesn't have anything to do with httpd, but clean install/update is fine.
Comment 5 Thomas Andrews 2023-07-06 01:59:28 CEST 
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2023-07-06 22:29:12 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 6 Mageia Robot 2023-07-07 07:56:20 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0216.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.