Bug 33296 - iperf new security issue CVE-2024-26306
Summary: iperf new security issue CVE-2024-26306
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-06-12 15:22 CEST by Nicolas Salguero
Modified: 2024-06-17 19:44 CEST (History)
5 users (show)

See Also:
Source RPM: iperf-3.14-1.mga10.src.rpm
CVE: CVE-2024-26306
Status comment: Fixed upstream in 3.17.1


Attachments

Description Nicolas Salguero 2024-06-12 15:22:16 CEST
SUSE has issued an advisory on June 11:
https://lists.suse.com/pipermail/sle-updates/2024-June/035556.html

The problem is solved in 3.17.1.

Mageia 9 is also affected.
Nicolas Salguero 2024-06-12 15:22:40 CEST

Status comment: (none) => Fixed upstream in 3.17.1
Source RPM: (none) => iperf-3.14-1.mga10.src.rpm
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2024-26306

Comment 1 Lewis Smith 2024-06-14 11:27:19 CEST
A homeless pkg, so assigning this update globally.
CC'ing MikeR who committed the current version also for a CVE.

CC: (none) => mhrambo3501
Assignee: bugsquad => pkg-bugs

Comment 2 David GEIGER 2024-06-15 12:10:34 CEST
Done for both mga9 and Cauldron!

Assigning to QA,

Packages in 9/Core/Updates_testing:
======================
iperf-3.17.1-1.mga9
libiperf-devel-3.17.1-1.mga9
libiperf0-3.17.1-1.mga9
lib64iperf-devel-3.17.1-1.mga9
lib64iperf0-3.17.1-1.mga9

From SRPMS:
iperf-3.17.1-1.mga9.src.rpm

Whiteboard: MGA9TOO => (none)
Assignee: pkg-bugs => qa-bugs
CC: (none) => geiger.david68210
Version: Cauldron => 9

katnatek 2024-06-15 19:40:04 CEST

Keywords: (none) => advisory

Comment 3 Len Lawrence 2024-06-15 23:03:14 CEST
mga9, x64

Installed the 14.1 packages then tried out the speed test between nodes on the LAN.  Results were as expected.  Watched a bit of a tutorial on Youtube to get information on iPerf which is apparently a commonly used tool, across different operating systems.

Then updated the candidate packages without issue.
Restarted the remote server as root.
# iperf3 -s
-----------------------------------------------------------
Server listening on 5201 (test #1)
-----------------------------------------------------------
[...]

On the local machine connected to the remote server as user:

$ iperf3 -c <remote> <This can be name or a.b.c.d>
Connecting to host remote, port 5201
[  5] local <a.b.c.d> port 39882 connected to  port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  10.5 MBytes  88.0 Mbits/sec    0    164 KBytes       
[  5]   1.00-2.00   sec  9.00 MBytes  75.5 Mbits/sec    0    164 KBytes       
[  5]   2.00-3.00   sec  9.88 MBytes  82.8 Mbits/sec    0    195 KBytes       
[  5]   3.00-4.00   sec  9.88 MBytes  82.8 Mbits/sec    0    158 KBytes       
[  5]   4.00-5.00   sec  9.62 MBytes  80.7 Mbits/sec    0    178 KBytes       
[  5]   5.00-6.00   sec  9.25 MBytes  77.6 Mbits/sec    0    209 KBytes       
[  5]   6.00-7.00   sec  9.62 MBytes  80.7 Mbits/sec    0    204 KBytes       
[  5]   7.00-8.00   sec  9.50 MBytes  79.7 Mbits/sec    0    184 KBytes       
[  5]   8.00-9.00   sec  9.38 MBytes  78.6 Mbits/sec    0    212 KBytes       
[  5]   9.00-10.00  sec  9.38 MBytes  78.6 Mbits/sec    0   5.66 KBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  96.0 MBytes  80.5 Mbits/sec    0             sender
[  5]   0.00-10.01  sec  94.4 MBytes  79.1 Mbits/sec                  receiver

iperf Done.

The results were in the expected range for ethernet over a Powerline connected to an ASUS gigabit router.

These seem to be OK.

CC: (none) => tarazed25
Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2024-06-16 04:15:30 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 5 Mageia Robot 2024-06-17 19:44:56 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0226.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.