Bug 33533 - python-tqdm new security issue CVE-2024-34062
Summary: python-tqdm new security issue CVE-2024-34062
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: https://lists.suse.com/pipermail/sle-...
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-09-06 10:07 CEST by Nicolas Salguero
Modified: 2024-09-13 19:16 CEST (History)
5 users (show)

See Also:
Source RPM: python-tqdm-4.64.1-2.mga9.src.rpm
CVE: CVE-2024-34062
Status comment: Patch available from upstream

Attachments
Add an attachment (proposed patch, testcase, etc.)

Nicolas Salguero 2024-09-06 10:07:53 CEST

Status comment: (none) => Patch available from upstream
CVE: (none) => CVE-2024-34062
Source RPM: (none) => python-tqdm-4.64.1-2.mga9.src.rpm

Comment 1 Marja Van Waes 2024-09-06 21:31:21 CEST 
Assigning to the Python Stack maintainers.

CC: (none) => marja11
URL: (none) => https://lists.suse.com/pipermail/sle-security-updates/2024-August/019257.html
Assignee: bugsquad => python

Comment 2 David GEIGER 2024-09-11 17:46:56 CEST 
Assigning to QA,

Packages in 9/Core/Updates_testing:
======================
python3-tqdm-4.64.1-2.1.mga9.noarch.rpm

From SRPMS:
python3-tqdm-4.64.1-2.1.mga9.src.rpm

Assignee: python => qa-bugs
CC: (none) => geiger.david68210

katnatek 2024-09-11 18:34:19 CEST

Keywords: (none) => advisory

Comment 3 katnatek 2024-09-12 01:11:05 CEST 
RH x86_64

LC_ALL=C python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""
hi
python3: no process found
Traceback (most recent call last):
  File "/usr/lib64/python3.10/runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/lib64/python3.10/runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "/usr/lib/python3.10/site-packages/tqdm/__main__.py", line 3, in <module>
    main()
  File "/usr/lib/python3.10/site-packages/tqdm/cli.py", line 264, in main
    cp('tqdm.1', path.join(manpath, 'tqdm.1'))
  File "/usr/lib/python3.10/site-packages/tqdm/cli.py", line 258, in cp
    copyfile(str(resources.files('tqdm') / name), dst)
  File "/usr/lib64/python3.10/shutil.py", line 254, in copyfile
    with open(src, 'rb') as fsrc:
FileNotFoundError: [Errno 2] No such file or directory: '/usr/lib/python3.10/site-packages/tqdm/tqdm.1'

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing python3-tqdm-4.64.1-2.1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: python3-tqdm          ##################################################################################################
      1/1: removing python3-tqdm-4.64.1-2.mga9.noarch
                                 ##################################################################################################
writing /var/lib/rpm/installed-through-deps.list

LC_ALL=C python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""
Traceback (most recent call last):
  File "/usr/lib64/python3.10/runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/lib64/python3.10/runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "/usr/lib/python3.10/site-packages/tqdm/__main__.py", line 3, in <module>
    main()
  File "/usr/lib/python3.10/site-packages/tqdm/cli.py", line 275, in main
    cp('tqdm.1', path.join(manpath, 'tqdm.1'))
  File "/usr/lib/python3.10/site-packages/tqdm/cli.py", line 269, in cp
    copyfile(str(resources.files('tqdm') / name), dst)
  File "/usr/lib64/python3.10/shutil.py", line 254, in copyfile
    with open(src, 'rb') as fsrc:
FileNotFoundError: [Errno 2] No such file or directory: '/usr/lib/python3.10/site-packages/tqdm/tqdm.1'

We can see the "hi" is not part of the output , I guess is OK

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2024-09-12 03:14:20 CEST 
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 5 papoteur 2024-09-12 13:56:55 CEST 
Installed.
I use a version of mgarepo which uses tqdm (sync command).
This still runs OK.

CC: (none) => yvesbrungard

Comment 6 Mageia Robot 2024-09-13 19:16:33 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0299.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.