31123 – xmlrpc-c new security issues CVE-2022-25236 CVE-2022-2531[345] CVE-2022-40674 CVE-2022-43680

Bug 31123 - xmlrpc-c new security issues CVE-2022-25236 CVE-2022-2531[345] CVE-2022-40674 CVE-2022-43680

Summary: xmlrpc-c new security issues CVE-2022-25236 CVE-2022-2531[345] CVE-2022-40674...

Status:	NEW

Alias:	None

Product:	Mageia
Classification:	Unclassified
Component:	Security (show other bugs)
Version:	Cauldron
Hardware:	All Linux

Priority:	Normal Severity: critical
Target Milestone:	---
Assignee:	All Packagers
QA Contact:	Sec team

URL:
Whiteboard:	MGA9TOO
Keywords:

Depends on:
Blocks:

Reported:	2022-11-14 19:00 CET by David Walser
Modified:	2024-06-15 09:32 CEST (History)
CC List:	3 users (show)

See Also:
Source RPM:	xmlrpc-c-1.51.07-4.mga9.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-11-14 19:00:36 CET

xmlrpc-c bundles expat code, which is vulnerable to security issues:
https://bugzilla.redhat.com/show_bug.cgi?id=2056370
https://bugzilla.redhat.com/show_bug.cgi?id=2056350
https://bugzilla.redhat.com/show_bug.cgi?id=2056354
https://bugzilla.redhat.com/show_bug.cgi?id=2056363
https://bugzilla.redhat.com/show_bug.cgi?id=2130769
https://bugzilla.redhat.com/show_bug.cgi?id=2140059

and possibly others.

David Walser 2022-11-14 19:00:59 CET

Whiteboard: (none) => MGA8TOO

Comment 1 Lewis Smith 2022-11-14 20:30:43 CET

Unsure who might be responsible for this, so assigning it globally; but CC'ing both NicolasS who has touched it recently, and neoclust who is the registered maintainer. If either of you take this up, please re-assign to yourself.

Assignee: bugsquad => pkg-bugs
CC: (none) => mageia, nicolas.salguero

Comment 2 David GEIGER 2024-06-15 09:32:29 CEST

Removing Mageia 8 from whiteboard due to EOL!

Whiteboard: MGA8TOO => MGA9TOO
CC: (none) => geiger.david68210

Note You need to log in before you can comment on or make changes to this bug.