RedHat has issued an advisory on April 30: https://lwn.net/Articles/971664/ The fix is: https://github.com/gdraheim/zziplib/commit/803f49aaae16b7f2899e4769afdfc673a21fa9e8 Mageia 9 is also affected.
Whiteboard: (none) => MGA9TOOStatus comment: (none) => Fixed upstream in 0.13.73 and patch available from upstreamSource RPM: (none) => zziplib-0.13.72-2.mga9.src.rpmCVE: (none) => CVE-2020-18770
Suggested advisory: ======================== The updated packages fix a security vulnerability: An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service. (CVE-2020-18770) References: https://lwn.net/Articles/971664/ ======================== Updated packages in core/updates_testing: ======================== lib(64)zziplib13-0.13.72-2.1.mga9 lib(64)zziplib-devel-0.13.72-2.1.mga9 zziplib-utils-0.13.72-2.1.mga9 from SRPM: zziplib-0.13.72-2.1.mga9.src.rpm
Whiteboard: MGA9TOO => (none)Status comment: Fixed upstream in 0.13.73 and patch available from upstream => (none)Assignee: bugsquad => qa-bugsStatus: NEW => ASSIGNEDVersion: Cauldron => 9
Keywords: (none) => advisory
Mageia9, x64 CVE-2020-18770 https://github.com/gdraheim/zziplib/issues/69 Ran the PoC test before updating and noted that the vulnerability had been taken care of already. $ unzzip-mem zip_poc.zip DEBUG: zzip_disk_entry_to_file_header : file header: offset out of bounds (0xe4c2f0) DEBUG: zzip_mem_entry_new : no header in entry DEBUG: zzip_mem_disk_load : unable to load entry DEBUG: zzip_mem_disk_open : unable to load disk zip_poc.zip Update via qarepo and drakrpm-update. The PoC test returned the same log messages as before. Tried out unzzip-mem on a regular file: $ unzzip-mem racc-master.zip $ tree racc-master racc-master ├── bin │ └── racc ├── ChangeLog [...] unzzip does the same thing apparently: $ unzzip ruby-deep-dive.zip $ tree ruby-deep-dive-v7 ruby-deep-dive-v7 ├── book │ ├── examples [...] $ urpmq --whatrequires-recursive lib64zziplib13 | sort -u asymptote asymptote-gui atril-dvi auto-multiple-choice cmsuper connecthys dblatex diskimage-builder <lots of things> Tried a couple of operations in the asymptote gui under strace but could not find any sign of access to zziplib. It probably requires a real session to expose it. This will have to do. Giving it the OK.
CC: (none) => tarazed25
Whiteboard: (none) => MGA9-64-OK
RH mageia 9 x86_64 LC_ALL=C urpmi --auto --auto-update medium "QA Testing (32-bit)" is up-to-date medium "QA Testing (64-bit)" is up-to-date medium "Core Release (distrib1)" is up-to-date medium "Core Updates (distrib3)" is up-to-date medium "Nonfree Release (distrib11)" is up-to-date medium "Nonfree Updates (distrib13)" is up-to-date medium "Tainted Release (distrib21)" is up-to-date medium "Tainted Updates (distrib23)" is up-to-date medium "Core 32bit Release (distrib31)" is up-to-date medium "Core 32bit Updates (distrib32)" is up-to-date medium "Nonfree 32bit Release (distrib36)" is up-to-date medium "Tainted 32bit Release (distrib41)" is up-to-date medium "Tainted 32bit Updates (distrib42)" is up-to-date installing lib64zziplib13-0.13.72-2.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/1: lib64zziplib13 ################################################################################################## 1/1: removing lib64zziplib13-0.13.72-2.mga9.x86_64 ################################################################################################## This indicates that the current version of the package already was in my system (AFAIK I not install by myself) Installl zziplib-utils LC_ALL=C urpmi zziplib-utils installing zziplib-utils-0.13.72-2.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/1: zziplib-utils ################################################################################################## unzip a .zip file with unzzip all the content in zip file is restored as expected
CC: (none) => andrewsfarm
Validating.
CC: (none) => sysadmin-bugsKeywords: (none) => validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0167.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED