Security issue in c-ares has been announced on February 23: https://www.openwall.com/lists/oss-security/2024/02/23/2 The issues are fixed upstream in 1.27.0: https://c-ares.org/changelog.html https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q The following commit fixes the issue: https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183 Mageia 9 is also affected.
Whiteboard: (none) => MGA9TOOCVE: (none) => CVE-2024-25629Status comment: (none) => Patch available from upstream and fixed upstream in 1.27.0Source RPM: (none) => c-ares-1.21.0-1.mga10.src.rpm
Our current v1.21.0 is only 3 months old. The update to v1.27.0 looks the easiest option. No particular packager for this SRPM, so assigning globally.
Assignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated packages fix a security vulnerability: Out of bounds read in ares__read_line(). (CVE-2024-25629) References: https://www.openwall.com/lists/oss-security/2024/02/23/2 https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q ======================== Updated packages in core/updates_testing: ======================== lib(64)cares2-1.19.1-1.1.mga9 lib(64)cares-devel-1.19.1-1.1.mga9 from SRPM: c-ares-1.19.1-1.1.mga9.src.rpm
Assignee: pkg-bugs => qa-bugsStatus: NEW => ASSIGNEDVersion: Cauldron => 9Source RPM: c-ares-1.21.0-1.mga10.src.rpm => c-ares-1.19.1-1.mga9.src.rpmWhiteboard: MGA9TOO => (none)Status comment: Patch available from upstream and fixed upstream in 1.27.0 => (none)
Keywords: (none) => advisory
Real Hardware Mageia 9 x86_64 installing lib64cares2-1.19.1-1.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/1: lib64cares2 ################################################################################################## 1/1: removing lib64cares2-1.19.1-1.mga9.x86_64 ################################################################################################## My package of megasync requires this library install the package not produce complain run from terminal without issue and still working
Whiteboard: (none) => MGA9-64-OK
Validating.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0051.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED