cURL has issued advisories today (December 6): https://curl.se/docs/CVE-2023-46218.html https://curl.se/docs/CVE-2023-46219.html The issues are fixed upstream in 8.5.0. Fix for CVE-2023-46218: https://github.com/curl/curl/commit/2b0994c29a721c91c57 Fix for CVE-2023-46219: https://github.com/curl/curl/commit/73b65e94f3531179de45 Mageia 9 is also affected.
Whiteboard: (none) => MGA9TOOStatus comment: (none) => Patches available from upstream and fixed upstream in 8.5.0Source RPM: (none) => curl-8.4.0-2.mga10.src.rpm
Note that an upstream packaging snafu means that https://github.com/curl/curl/raw/master/tests/errorcodes.pl will need to be added to the source tree or "!1477" added to TEST_Q= in the %check section to skip that test. Or, wait for 8.5.1 which might be released in a few days.
CC: (none) => dan
Dan, is it OK to assign this to you as you did the Update to ver. 8.4.0 to fix CVEs, and clearly know this beast.
Assignee: bugsquad => dan
Sure, I can take care of it tomorrow.
Status: NEW => ASSIGNED
Updates have been pushed to Cauldron, mga8 and mga9.
Advisory ################################################################ Updated curl packages fix vulnerabilities References ################################################################ CVE-2023-46218 CVE-2023-46219 Packages in 8/core/updates_testing ################################################################ curl-7.74.0-1.15.mga8.x86_64.rpm curl-examples-7.74.0-1.15.mga8.noarch.rpm lib64curl-devel-7.74.0-1.15.mga8.x86_64.rpm lib64curl4-7.74.0-1.15.mga8.x86_64.rpm SRPMS ################################################################ curl-7.74.0-1.15.mga8 Packages in 8/core/updates_testing ################################################################ curl-7.88.1-3.3.mga9.x86_64.rpm curl-examples-7.88.1-3.3.mga9.noarch.rpm lib64curl-devel-7.88.1-3.3.mga9.x86_64.rpm lib64curl4-7.88.1-3.3.mga9.x86_64.rpm SRPMS ################################################################ curl-7.88.1-3.3.mga9
Assignee: dan => qa-bugsWhiteboard: MGA9TOO => MGA9TOO MGA8TOO
Advisory ################################################################ Updated curl packages fix vulnerabilities References ################################################################ CVE-2023-46218 CVE-2023-46219 Packages in 8/core/updates_testing ################################################################ curl-7.74.0-1.15.mga8.x86_64.rpm curl-examples-7.74.0-1.15.mga8.noarch.rpm lib64curl-devel-7.74.0-1.15.mga8.x86_64.rpm lib64curl4-7.74.0-1.15.mga8.x86_64.rpm SRPMS ################################################################ curl-7.74.0-1.15.mga8 Packages in 9/core/updates_testing ################################################################ curl-7.88.1-3.3.mga9.x86_64.rpm curl-examples-7.88.1-3.3.mga9.noarch.rpm lib64curl-devel-7.88.1-3.3.mga9.x86_64.rpm lib64curl4-7.88.1-3.3.mga9.x86_64.rpm SRPMS ################################################################ curl-7.88.1-3.3.mga9
Source RPM: curl-8.4.0-2.mga10.src.rpm => curl-7.74.0-1.14.mga8.src.rpm,curl-7.88.1-3.1.mga9.src.rpmStatus comment: Patches available from upstream and fixed upstream in 8.5.0 => Advisory in comment#5
Status comment: Advisory in comment#5 => Advisory in comment#6
Tested on VM Mageia 8 i586 Packages updates from current version without issues Download a file with curl without issues
Tested on Real Hardware Mageia 9 x86_64 Packages updates from current version without issues Install packages with urpmi using curl as downloader without issues
Version: Cauldron => 9Whiteboard: MGA9TOO MGA8TOO => MGA8TOO
CVE: (none) => CVE-2023-46218, CVE-2023-46219CC: (none) => marja11
Advisory based on comment 6 and the changelog mails added to SVN. Please remove the "advisory" keyword if it needs to be changed. It also helps when obsolete advisories are tagged as "obsolete"
Keywords: (none) => advisory
MGA9-64 MATE on HP-Pavillion No installation issues Ref bug 32362 for testing $ rm -f /tmp/cookiejar /tmp/out.html $ curl -d name=yummy -d value=chocolate -d path=/ -b /tmp/cookiejar -c /tmp/cookiejar https://setcookie.net/ -o /tmp/out.html % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 4252 100 4219 100 33 9675 75 --:--:-- --:--:-- --:--:-- 9752 $ curl -d name=yummy -d value=chocolate -d path=/ -b /tmp/cookiejar -c /tmp/cookiejar https://setcookie.net/ -o /tmp/out.html % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 4301 100 4268 100 33 20797 160 --:--:-- --:--:-- --:--:-- 21083 $ grep ' = ' /tmp/out.html <li><code>yummy = chocolate</code></li> Installed tor and get it running, then $ curl -x socks5h://localhost:9050 https://ident.me 199.195.253.180[tester9@mach4 ~]$ [tester9@mach4 ~]$ curl https://ident.me 213.219.163.134[tester9@mach4 ~]$ Is OK.
CC: (none) => herman.viaeneWhiteboard: MGA8TOO => MGA8TOO MGA9-4-OK
Whiteboard: MGA8TOO MGA9-4-OK => MGA8TOO MGA9-64-OK
MGA8-64 Plasma in VirtualBox. No installation issues. Made sure the tools in MCC were set to use curl, then went to drakrpm and installed a package that was known to have an update. No issues installing that package or its dependencies. Then I used MCC to get updates, which updated the previously installed package. Looks OK here, too. Giving the OKs for MGA8 based on this test and on comment 7. Validating.
Keywords: (none) => validated_updateWhiteboard: MGA8TOO MGA9-64-OK => MGA8TOO MGA9-64-OK MGA8-32-OK MGA8-64-OKCC: (none) => andrewsfarm, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0345.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED