Bug 32091 - mingw-nsis new security issue CVE-2023-37378
Summary: mingw-nsis new security issue CVE-2023-37378
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-07-10 22:27 CEST by David Walser
Modified: 2023-07-19 21:55 CEST (History)
4 users (show)

See Also:
Source RPM: mingw-nsis-3.08-2.mga9.src.rpm
CVE:
Status comment: Fixed upstream in 3.09


Attachments

Description David Walser 2023-07-10 22:27:51 CEST
Debian-LTS has issued an advisory on July 7:
https://www.debian.org/lts/security/2023/dla-3483

The issue is fixed upstream in 3.09.

Mageia 8 is also affected.
David Walser 2023-07-10 22:28:34 CEST

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 3.09

Comment 1 David GEIGER 2023-07-11 10:50:31 CEST
Done for both mga8 and cauldron!

freeze_move requested for cauldron!


Packages in 8/Core/Updates_testing:
======================
mingw32-nsis-3.06.1-1.1.mga8.x86_64.rpm

From SRPMS:
mingw-nsis-3.06.1-1.1.mga8.src.rpm

CC: (none) => geiger.david68210
Assignee: bugsquad => qa-bugs

Comment 2 Herman Viaene 2023-07-12 15:37:13 CEST
Trying to follow bug 21813, but I get:
$ makensis Example1.nsi 
Processing config: /etc/nsisconf.nsh
Can't open script "Example1.nsi"
Not a problem of access rights.

CC: (none) => herman.viaene

Comment 3 Dave Hodgins 2023-07-12 16:47:25 CEST
I just installed mingw32-nsis-3.06.1-1.1.mga8.x86_64.rpm

Having manually created /tmp/tmp (for easy deletion after testing),
copied /usr/share/doc/mingw-nsis/Examples/ to /tmp/tmp/ including the
sub directories ...

$ cd /tmp/tmp/Examples/
$ pwd
/tmp/tmp/Examples
$ makensis example1.nsi
Processing config: /etc/nsisconf.nsh
Processing script file: "example1.nsi" (UTF8)

Processed 1 file, writing output (x86-unicode):

Output: "example1.exe"
Install: 2 pages (128 bytes), 1 section (32792 bytes), 3 instructions (84 bytes), 222 strings (1758 bytes), 1 language table (230 bytes).

Using zlib compression.

EXE header size:               92160 / 93184 bytes
Install code:                   1033 / 19000 bytes
Install data:                    486 / 995 bytes
CRC (0x2E352F3E):                  4 / 4 bytes

Total size:                    93683 / 113183 bytes (82.7%)

Herman, did you cd to the Examples directory you just copied from /usr or
not include the sub directories when copying?

CC: (none) => davidwhodgins

Comment 4 David GEIGER 2023-07-12 19:32:10 CEST
package moved to Core/Release for cauldron!

Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8

Comment 5 Herman Viaene 2023-07-13 08:40:27 CEST
@Dave: No, I just copied one single example.nsi file. Will follow your recommendation.
Comment 6 Herman Viaene 2023-07-14 11:05:00 CEST
Copied /usr/share/doc/mingw-nsis/Examples/ to ~/tmp
$ cd tmp/Examples/
$ makensis example1.nsi
Processing config: /etc/nsisconf.nsh
Processing script file: "example1.nsi" (UTF8)

Processed 1 file, writing output (x86-unicode):

Output: "example1.exe"
Install: 2 pages (128 bytes), 1 section (32792 bytes), 3 instructions (84 bytes), 222 strings (1758 bytes), 1 language table (230 bytes).

Using zlib compression.

EXE header size:               92160 / 93184 bytes
Install code:                   1033 / 19000 bytes
Install data:                    486 / 995 bytes
CRC (0x2E352F3E):                  4 / 4 bytes

Total size:                    93683 / 113183 bytes (82.7%)
 That confirms the result Dave got and is equivalent with bug 21813, so good to go.

Whiteboard: (none) => MGA8-64-OK

Comment 7 Dave Hodgins 2023-07-14 15:09:22 CEST
Advisory committed to svn. Validating the update.

Keywords: (none) => advisory, validated_update
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2023-07-19 21:55:04 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0236.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.