Astraight version update. Assigning globally.

Assignee: bugsquad => pkg-bugs

Assigning to the registered maintainer!

Assignee: pkg-bugs => cooker
CC: (none) => geiger.david68210

Cauldron was fixed!

Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)

Debian has issued an advisory on September 18:
https://lwn.net/Articles/990818/

CVE-2023-40533 is an duplicate of CVE-2022-40468.

Status comment: Fixed upstream in 1.11.2 => Patches available from Debian
Summary: tinyproxy new security issues CVE-2022-40468, CVE-2023-40533 and CVE-2023-49606 => tinyproxy new security issues CVE-2022-40468 and CVE-2023-49606
CVE: CVE-2022-40468, CVE-2023-40533, CVE-2023-49606 => CVE-2022-40468, CVE-2023-49606

Ubuntu has issued an advisory for CVE-2022-40468 on December 9:
https://ubuntu.com/security/notices/USN-7140-1

Patch in https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/tinyproxy/1.10.0-4ubuntu0.1/tinyproxy_1.10.0-4ubuntu0.1.debian.tar.xz

Ubuntu has issued an advisory for CVE-2023-49606 on January 8:
https://ubuntu.com/security/notices/USN-7190-1

Patch in https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/tinyproxy/1.10.0-4ubuntu0.2/tinyproxy_1.10.0-4ubuntu0.2.debian.tar.xz

Suggested advisory:
========================

The updated package fixes security vulnerabilities:

Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.. (CVE-2022-40468)

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability. (CVE-2023-49606)

References:
https://www.openwall.com/lists/oss-security/2024/05/07/1
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/
https://lwn.net/Articles/990818/
https://ubuntu.com/security/notices/USN-7140-1
https://ubuntu.com/security/notices/USN-7190-1
========================

Updated package in core/updates_testing:
========================
tinyproxy-1.10.0-3.1.mga9

from SRPM:
tinyproxy-1.10.0-3.1.mga9.src.rpm

Assignee: cooker => qa-bugs
Status comment: Patches available from Debian => (none)
Status: NEW => ASSIGNED

MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 7898 for testing, and found same rather erratic behavior:
Start command hangs whether using service start or systemctl
Stus says loaded and activating (not activated), and after some time there is a time-out.
But putting firefox to  proxy localhost port 8888, works OK.
Give the stop command, and firefox continues to connect.
Use ps -aux and see processes tinyproxy  running.
Kill the first process (main for the other ones), and firefox cannot connect anymore.
So basically, this is the same behavior as described in bug 7898, so no regression, good (well not really IMHO) to go, unless someone else can contradict me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0003.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED