Hi, Those CVEs were announced here: https://www.openwall.com/lists/oss-security/2023/10/05/4 They are fixed by patches provided in the above message. Best regards, Nico.
Status comment: (none) => Patch available from upstreamCC: (none) => nicolas.salgueroWhiteboard: (none) => MGA9TOO, MGA8TOOSource RPM: (none) => cadence-0.9.1-7.mga9.src.rpm
The CVE link is well worth a read. Essentially it says that cadence is deprecated and should be moved away from; but is still necessary "when using the Jack audio system". Various packagers have committed this, so assigning the bug globally.
Assignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated packages fix security vulnerabilities: Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created by a local adversary before Cadence started. The adversary can then delete the file, disrupting Cadence. (CVE-2023-43782) Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created by a local adversary before Cadence started. The adversary can leverage this to create or overwrite files via a symlink attack. In some kernel configurations, code injection into the Wine registry is possible. (CVE-2023-43783) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43782 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43783 https://www.openwall.com/lists/oss-security/2023/10/05/4 ======================== Updated packages in 9/core/updates_testing: ======================== cadence-0.9.1-7.1.mga9 cadence-data-0.9.1-7.1.mga9 cadence-tools-0.9.1-7.1.mga9 catarina-0.9.1-7.1.mga9 catia-0.9.1-7.1.mga9 claudia-0.9.1-7.1.mga9 from SRPM: cadence-0.9.1-7.1.mga9.src.rpm Updated packages in 8/core/updates_testing: ======================== cadence-0.9.1-3.1.mga8 cadence-data-0.9.1-3.1.mga8 cadence-tools-0.9.1-3.1.mga8 catarina-0.9.1-3.1.mga8 catia-0.9.1-3.1.mga8 claudia-0.9.1-3.1.mga8 from SRPM: cadence-0.9.1-3.1.mga8.src.rpm
Status: NEW => ASSIGNEDVersion: Cauldron => 9Status comment: Patch available from upstream => (none)Assignee: pkg-bugs => qa-bugsWhiteboard: MGA9TOO, MGA8TOO => MGA8TOO
Advisory from comment 2 added to SVN. Please remove the "advisory" keyword if it needs to be changed.
CC: (none) => marja11Keywords: (none) => advisory
MGA9-64 Xfce on Acer Aspire 5253 No installation issues No previous updates, hunting for some tutorial is complicated by the fact that there is at least one other program with the same name doing something completely different and is quite popular on Google. This package seems to be some simulation of patching different sound in- and outputs, not exactly my kind of expertise. Anyway, in the front, I can start jack and bridge pulsaudio. Then there is a tools section and most of those do something that seems reasonable, except the claudia tool which throws an error. Info on the CLI: /usr/bin/python3 /usr/share/cadence/src/claudia.py & Using Tray Engine 'Qt' Traceback (most recent call last): File "/usr/lib64/python3.10/site-packages/dbus/bus.py", line 173, in activate_name_owner return self.get_name_owner(bus_name) File "/usr/lib64/python3.10/site-packages/dbus/bus.py", line 348, in get_name_owner return self.call_blocking(BUS_DAEMON_NAME, BUS_DAEMON_PATH, File "/usr/lib64/python3.10/site-packages/dbus/connection.py", line 634, in call_blocking reply_message = self.send_message_with_reply_and_block( dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NameHasNoOwner: Could not get owner of name 'org.ladish': no such name During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/share/cadence/src/claudia.py", line 2753, in <module> gDBus.ladish_control = gDBus.bus.get_object("org.ladish", "/org/ladish/Control") File "/usr/lib64/python3.10/site-packages/dbus/bus.py", line 237, in get_object return self.ProxyObjectClass(self, bus_name, object_path, File "/usr/lib64/python3.10/site-packages/dbus/proxies.py", line 250, in __init__ self._named_service = conn.activate_name_owner(bus_name) File "/usr/lib64/python3.10/site-packages/dbus/bus.py", line 178, in activate_name_owner self.start_service_by_name(bus_name) File "/usr/lib64/python3.10/site-packages/dbus/bus.py", line 273, in start_service_by_name return (True, self.call_blocking(BUS_DAEMON_NAME, BUS_DAEMON_PATH, File "/usr/lib64/python3.10/site-packages/dbus/connection.py", line 634, in call_blocking reply_message = self.send_message_with_reply_and_block( dbus.exceptions.DBusException: org.freedesktop.DBus.Error.ServiceUnknown: The name org.ladish was not provided by any .service files Help !!!!
CC: (none) => herman.viaene
Not my area either, Herman. I wouldn't have gotten as far as you have. I'll set the feedback flag and ask for help on the ML.
Keywords: (none) => feedbackCC: (none) => andrewsfarm
Hi. I saw your note on the QA ML. I gave it a try. You need to be part of the group audio. But the issue with Claudia is not because of this. I have found: https://github.com/falkTX/Cadence/issues/319 Maybe a look at openSUSE package could help. Sorry, don't have time to do more right now.
CC: (none) => chb0
CC: (none) => mageia
It looks like this is an ongoing problem with Cadence/Claudia. Christian's link was dated May 2021, but there is this from another post dated December 2017: "For now you can package things and remove ladish as dependency. There is no build-time dependency on time, so this is fine. Claudia will refuse to start, but the rest of the cadence suite still works fine." Since this is a security update and the Claudia issue apparently is not a new regression, it won't stop this update. Removing the feedback flag, and giving this an MGA9 OK based on comment 5 and comment 6. Now we need a test on MGA8, and then it can be validated.
Whiteboard: MGA8TOO => MGA8TOO MGA9-64-OKKeywords: feedback => (none)
MGA8-64 Plasma in VirtualBox. Installed packages, made my user a member of the audio group, and ran Cadence from the CLI. Started Jack, bridged to pulseaudio, confirmed that the tools appear to work, except for Claudia. Updated using Qarepo, with no installation issues. Ran it again, repeated the previous actions, with the same results, showing no new regressions that I can see. Giving this an MGA8 OK, and validating.
Keywords: (none) => validated_updateWhiteboard: MGA8TOO MGA9-64-OK => MGA8TOO MGA8-64-OK MGA9-64-OKCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0297.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED