Bug 32113 - kanboard new security issue CVE-2023-36813
Summary: kanboard new security issue CVE-2023-36813
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-07-17 21:54 CEST by David Walser
Modified: 2024-11-24 14:04 CET (History)
6 users (show)

See Also:
Source RPM: kanboard
CVE: CVE-2023-36813
Status comment:


Attachments

Description David Walser 2023-07-17 21:54:32 CEST
Debian has issued an advisory on July 16:
https://www.debian.org/security/2023/dsa-5454

The issue is fixed upstream in 1.2.31:
https://github.com/kanboard/kanboard/security/advisories/GHSA-9gvq-78jp-jxcx

Mageia 8 is also affected.
David Walser 2023-07-17 21:54:51 CEST

Status comment: (none) => Fixed upstream in 1.2.31
Whiteboard: (none) => MGA8TOO

Comment 1 Lewis Smith 2023-07-19 21:01:19 CEST
Little activity on this, various packagers, so assigning globally.

Assignee: bugsquad => pkg-bugs

Comment 2 David GEIGER 2024-06-15 09:21:10 CEST
Removing Mageia 8 from whiteboard due to EOL!

CC: (none) => geiger.david68210
Whiteboard: MGA8TOO => MGA9TOO

papoteur 2024-11-19 13:53:29 CET

CC: (none) => yvesbrungard
Assignee: pkg-bugs => qa-bugs
Source RPM: kanboard-1.0.8-6.mga9.src.rpm => kanboard
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
Status comment: Fixed upstream in 1.2.31 => (none)

Comment 3 papoteur 2024-11-19 13:55:37 CET
SRPM:
kanboard-1.2.42-1.mga9
RPMS:
kanboard-1.2.42-1.mga9.noarch
papoteur 2024-11-19 13:55:55 CET

CVE: (none) => CVE-2023-36813

katnatek 2024-11-19 18:58:54 CET

Keywords: (none) => advisory

Comment 4 katnatek 2024-11-19 23:25:20 CET
Out of my league here, just can test clean installation

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing kanboard-1.2.42-1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: kanboard              ##################################################################################################
      1/1: removing kanboard-1.0.8-6.mga9.noarch
                                 ##################################################################################################

systemctl restart httpd.service
http://localhost/kanboard/
Internal Error: This PHP extension is required: "gd"
Install php-gd
http://localhost/kanboard/
Internal Error: This PHP extension is required: "ctype"
Install php-ctype
http://localhost/kanboard/
Internal Error: This PHP extension is required: "filter"
Install php-filter
http://localhost/kanboard/
Internal Error: This PHP extension is required: "dom"
Install php-dom

Finally, I could get the Sign in page

papoteur please add php-gd, php-ctype, php-filter & php-dom as requires
Comment 5 papoteur 2024-11-20 10:34:48 CET
Submitting:
SRPMS:
kanboard-1.2.42-1.1.mga9
RPMS:
kanboard-1.2.42-1.1.mga9.noarch
Comment 6 papoteur 2024-11-20 10:36:03 CET
The last submission adds requirements.
I presume that the application is accessible through 
http://localhost/kanboard
Comment 7 Herman Viaene 2024-11-20 17:11:41 CET
MGA9-64 Plasma Wayland on HP-Pavillion
No installation issues.
Following papoteur I guessed httpd has to run.
Then the link brings to a login screen.
Found info at https://docs.kanboard.org/v1/admin/installation
logged in with default and was able to open a new project and a new task in it.
Seems to work OK.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 8 katnatek 2024-11-20 18:02:07 CET
As additional test

LC_ALL=C urpmi kanboard
To satisfy dependencies, the following packages are going to be installed:
  Package                        Version      Release       Arch    
(medium "Core Release (distrib1)")
  kanboard                       1.0.8        6.mga9        noarch  
(medium "Core Updates (distrib3)")
  php-mbstring                   8.2.25       1.mga9        x86_64  
  php-pdo                        8.2.25       1.mga9        x86_64  
  php-pdo_sqlite                 8.2.25       1.mga9        x86_64  
4.1MB of additional disk space will be used.
1.3MB of packages will be retrieved.
Proceed with the installation of the 4 packages? (Y/n) y

    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/kanboard-1.0.8-6.mga9.noarch.rpm
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/php-pdo-8.2.25-1.mga9.x86_64.rpm               
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/php-mbstring-8.2.25-1.mga9.x86_64.rpm          
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/php-pdo_sqlite-8.2.25-1.mga9.x86_64.rpm        
installing php-pdo_sqlite-8.2.25-1.mga9.x86_64.rpm php-mbstring-8.2.25-1.mga9.x86_64.rpm kanboard-1.0.8-6.mga9.noarch.rpm php-pdo-8.2.25-1.mga9.x86_64.rpm from /var/cache/urpmi/rpms
Preparing...                     ##################################################################################################
      1/4: php-pdo               ##################################################################################################
      2/4: php-pdo_sqlite        ##################################################################################################
      3/4: php-mbstring          ##################################################################################################
      4/4: kanboard              ##################################################################################################

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/php-dom-8.2.25-1.mga9.x86_64.rpm
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/php-gd-8.2.25-1.mga9.x86_64.rpm                
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/php-filter-8.2.25-1.mga9.x86_64.rpm            
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/php-ctype-8.2.25-1.mga9.x86_64.rpm             
installing //home/katnatek/qa-testing/x86_64/kanboard-1.2.42-1.1.mga9.noarch.rpm                                                    
/var/cache/urpmi/rpms/php-ctype-8.2.25-1.mga9.x86_64.rpm
/var/cache/urpmi/rpms/php-filter-8.2.25-1.mga9.x86_64.rpm
/var/cache/urpmi/rpms/php-gd-8.2.25-1.mga9.x86_64.rpm
/var/cache/urpmi/rpms/php-dom-8.2.25-1.mga9.x86_64.rpm
Preparing...                     ##################################################################################################
      1/5: php-dom               ##################################################################################################
      2/5: php-gd                ##################################################################################################
      3/5: php-filter            ##################################################################################################
      4/5: php-ctype             ##################################################################################################
      5/5: kanboard              ##################################################################################################
      1/1: removing kanboard-1.0.8-6.mga9.noarch
                                 ##################################################################################################

systemctl restart httpd.service

http://localhost/kanboard now loads OK

With the test in comment#7 and this should be enough

CC: (none) => andrewsfarm

Comment 9 Morgan Leijström 2024-11-21 14:30:19 CET
IMO this package need better description to get user easily able to use it.

1) I think it should clearly say it need apache web server and will install it as a dependency.  (Some users may not ant that complexity.)

2) the old URL http://www.kanboard.net
should be updated to https://kanboard.org/

3) Some minimal info how to start it (systemctl restart httpd.service) and whatever more is needed, (link to a *good simple* description upstream? and to surf to http://localhost/kanboard/

---

Clean install using drakrpm, testing media enabled

Then:
$ sudo systemctl restart httpd.service

Surfing to http://localhost/kanboard/ returns access denied.

(need to fix owner of data dir?)

CC: (none) => fri

Comment 10 Morgan Leijström 2024-11-21 17:14:04 CET
/usr/share/kanboard/data is owned by apache.
So what is missing?
Comment 11 katnatek 2024-11-21 18:12:45 CET
(In reply to Morgan Leijström from comment #10)
> /usr/share/kanboard/data is owned by apache.
> So what is missing?

As Herman and I not have issues I think could be the initial configuration of apache, I use MCC for that and perhaps Herman too
Comment 12 Morgan Leijström 2024-11-21 18:24:00 CET
Could be.
Here, apache was not installed before.
I just selected kanboard in drakrpm and it installed
(from rpm -qa --last):

php8.3-session-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:27
php8.3-cgi-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:27
kanboard-1.2.42-1.1.mga9.noarch               tor 21 nov 2024 14:02:27
webserver-base-2.0-16.mga9.noarch             tor 21 nov 2024 14:02:26
php8.3-sysvsem-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:26
php8.3-pdo_sqlite-8.3.13-1.mga9.x86_64        tor 21 nov 2024 14:02:26
php8.3-pdo-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:26
php8.3-mbstring-8.3.13-1.mga9.x86_64          tor 21 nov 2024 14:02:26
php8.3-ini-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:26
php8.3-gd-8.3.13-1.mga9.x86_64                tor 21 nov 2024 14:02:26
php8.3-filter-8.3.13-1.mga9.x86_64            tor 21 nov 2024 14:02:26
php8.3-dom-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:26
php8.3-ctype-8.3.13-1.mga9.x86_64             tor 21 nov 2024 14:02:26
apache-2.4.62-1.mga9.x86_64                   tor 21 nov 2024 14:02:26
php8.3-zlib-8.3.13-1.mga9.x86_64              tor 21 nov 2024 14:02:25
php8.3-sysvshm-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:25
php8.3-openssl-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:25
php8.3-cli-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:25
Comment 13 katnatek 2024-11-21 18:31:08 CET
(In reply to Morgan Leijström from comment #12)
> Could be.
> Here, apache was not installed before.
> I just selected kanboard in drakrpm and it installed
> (from rpm -qa --last):
> 
> php8.3-session-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:27
> php8.3-cgi-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:27
> kanboard-1.2.42-1.1.mga9.noarch               tor 21 nov 2024 14:02:27
> webserver-base-2.0-16.mga9.noarch             tor 21 nov 2024 14:02:26
> php8.3-sysvsem-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:26
> php8.3-pdo_sqlite-8.3.13-1.mga9.x86_64        tor 21 nov 2024 14:02:26
> php8.3-pdo-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:26
> php8.3-mbstring-8.3.13-1.mga9.x86_64          tor 21 nov 2024 14:02:26
> php8.3-ini-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:26
> php8.3-gd-8.3.13-1.mga9.x86_64                tor 21 nov 2024 14:02:26
> php8.3-filter-8.3.13-1.mga9.x86_64            tor 21 nov 2024 14:02:26
> php8.3-dom-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:26
> php8.3-ctype-8.3.13-1.mga9.x86_64             tor 21 nov 2024 14:02:26
> apache-2.4.62-1.mga9.x86_64                   tor 21 nov 2024 14:02:26
> php8.3-zlib-8.3.13-1.mga9.x86_64              tor 21 nov 2024 14:02:25
> php8.3-sysvshm-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:25
> php8.3-openssl-8.3.13-1.mga9.x86_64           tor 21 nov 2024 14:02:25
> php8.3-cli-8.3.13-1.mga9.x86_64               tor 21 nov 2024 14:02:25

Check if you have apache-mod_php or php-fpm-apache for php8.3
Comment 14 Morgan Leijström 2024-11-21 20:35:47 CET
Neither.

BUT!!  php8.3 ??  i got that version as dep of kanboard.
Thank you for opening my eyes!

There is apparantly a bug in drakrpm, installing php8.3 packages from the disabled backport repo, in comment 12, where I just accepted all deps of kanboard.

I now removed all php8.3*, and when i tell drakrpm i want php-session, i get correctly:
- php-cgi-8.2.25-1.mga9.x86_64
- php-ini-8.2.25-1.mga9.x86_64
- php-openssl-8.2.25-1.mga9.x86_64
- php-session-8.2.25-1.mga9.x86_64
- php-sysvsem-8.2.25-1.mga9.x86_64
- php-sysvshm-8.2.25-1.mga9.x86_64
- php-zlib-8.2.25-1.mga9.x86_64
And install them.
But if I  now tell drakrpm i want kanboard it want to get all the php8.3 packages, that is true for both kanboard 1.0.8 and 1.2.42.

backport repos are disabled already, but after I *remove* them, it is OK.

-------------
Back to start, removed core/backport repo and redo install, it works:

Removed all php packages, kanboard, apache, webserver-base and start over:

18 packages:
- apache-2.4.62-1.mga9.x86_64
- apache-mod_php-8.2.25-1.mga9.x86_64
- kanboard-1.2.42-1.1.mga9.noarch
- php-cli-8.2.25-1.mga9.x86_64
- php-ctype-8.2.25-1.mga9.x86_64
- php-dom-8.2.25-1.mga9.x86_64
- php-filter-8.2.25-1.mga9.x86_64
- php-gd-8.2.25-1.mga9.x86_64
- php-ini-8.2.25-1.mga9.x86_64
- php-mbstring-8.2.25-1.mga9.x86_64
- php-openssl-8.2.25-1.mga9.x86_64
- php-pdo-8.2.25-1.mga9.x86_64
- php-pdo_sqlite-8.2.25-1.mga9.x86_64
- php-session-8.2.25-1.mga9.x86_64
- php-sysvsem-8.2.25-1.mga9.x86_64
- php-sysvshm-8.2.25-1.mga9.x86_64
- php-zlib-8.2.25-1.mga9.x86_64
- webserver-base-2.0-16.mga9.noarch

$ sudo systemctl restart httpd.service

http://localhost/kanboard/ shows a login dialogue
 default login and password is admin/admin
I created a project, and clicked around a bit.

So this package is OK (minus maybe the info, comment 9)

We thought the backport issue was solved in Bug 31208
I will reopen it with this bug as example.
Comment 15 Thomas Andrews 2024-11-21 22:59:30 CET
Thank you, Morgan. Validating.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 16 Mageia Robot 2024-11-22 08:26:06 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0366.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 17 Morgan Leijström 2024-11-24 14:04:12 CET
Addendum: for others trying this (or writing install documentation) you may want kanban/apache to be running automatically after reboot.  One way is to in MCC -> System - Services -> checkmark httpd to be started at boot.

Note You need to log in before you can comment on or make changes to this bug.