Bug 33595 - openjpeg2 new security issue CVE-2023-39327
Summary: openjpeg2 new security issue CVE-2023-39327
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-09-27 10:16 CEST by Nicolas Salguero
Modified: 2024-10-04 07:28 CEST (History)
3 users (show)

See Also:
Source RPM: openjpeg2-2.5.0-1.mga9.src.rpm
CVE: CVE-2023-39327
Status comment:


Attachments

Description Nicolas Salguero 2024-09-27 10:16:15 CEST
Ubuntu has issued an advisory on September 26:
https://ubuntu.com/security/notices/USN-7037-1
Nicolas Salguero 2024-09-27 10:16:53 CEST

Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2023-39327
Status comment: (none) => Patch available from Ubuntu
Source RPM: (none) => openjpeg2-2.5.2-1.mga10.src.rpm, openjpeg2-2.5.0-1.mga9.src.rpm

Comment 1 Lewis Smith 2024-09-27 20:39:35 CEST
This patch link is more adminstriative:
https://github.com/uclouvain/openjpeg/pull/1547
This one looks to be the patch:
https://github.com/uclouvain/openjpeg/commit/c58bc128b4f770e7c89bc8ba3d0273b9a3904aad

Assigning globally.

Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Salguero 2024-10-01 09:53:06 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. (CVE-2023-39327)

References:
https://ubuntu.com/security/notices/USN-7037-1
========================

Updated packages in core/updates_testing:
========================
lib(64)openjp2_7-2.5.0-1.1.mga9
lib(64)openjpeg2-devel-2.5.0-1.1.mga9
openjpeg2-2.5.0-1.1.mga9

from SRPM:
openjpeg2-2.5.0-1.1.mga9.src.rpm

Source RPM: openjpeg2-2.5.2-1.mga10.src.rpm, openjpeg2-2.5.0-1.mga9.src.rpm => openjpeg2-2.5.0-1.mga9.src.rpm
Whiteboard: MGA9TOO => (none)
Status comment: Patch available from Ubuntu => (none)
Version: Cauldron => 9
Assignee: pkg-bugs => qa-bugs
Status: NEW => ASSIGNED

katnatek 2024-10-01 19:55:12 CEST

Keywords: (none) => advisory

Comment 3 katnatek 2024-10-01 20:37:58 CEST
RH x86_64

LC_ALL=C urpmi --auto --auto-update 
adding 3 new rpms not available in existing hdlist
replacing /var/cache/urpmi/partial/synthesis.hdlist.cz with synthesis.hdlist.cz.tmp
updating /var/cache/urpmi/partial/MD5SUM
updated medium "QA Testing (64-bit)"
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing lib64openjp2_7-2.5.0-1.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: lib64openjp2_7        ##################################################################################################
      1/1: removing lib64openjp2_7-2.5.0-1.mga9.x86_64
                                 ##################################################################################################

LC_ALL=C urpmi openjpeg2


installing openjpeg2-2.5.0-1.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: openjpeg2             ##################################################################################################

I not test the poc before the update

pj_decompress -i bigloop -o te.raw

===========================================
The extension of this file is incorrect.
FOUND loop. SHOULD BE .j2k or .jpc or .j2c or .jhc
===========================================

[INFO] Start to read j2k main header (0).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Header of tile 1 / 1041 has been read.
[WARNING] Not enough space for expected SOP marker
[ERROR] Not enough space for required EPH marker
[ERROR] Failed to decode.
[ERROR] Failed to decode tile 1/1041
ERROR -> opj_decompress: failed to decode image!

Looks good to me
Comment 4 katnatek 2024-10-02 02:17:45 CEST
RH x86_64

strace chromium-browser contain
openat(AT_FDCWD, "/lib64/libopenjp2.so.7", O_RDONLY|O_CLOEXEC) = 3

Tested with chromium-browser from bug#33443
Comment 5 Len Lawrence 2024-10-02 19:24:31 CEST
Tried the poc beore updating: to back up katnatek's test.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39327
Points to these links:
https://github.com/uclouvain/openjpeg/issues/1472
https://github.com/pic4xiu/pocRep/blob/main/bigloop

$ opj_decompress -i bigloop -o te.raw > dumpfile
===========================================
The extension of this file is incorrect.
FOUND loop. SHOULD BE .j2k or .jpc or .j2c or .jhc
===========================================
....
^C
$ ll dumpfile
-rw-r--r-- 1 lcl lcl 23167369216 Oct  2 18:01 dumpfile

$ head dumpfile
[INFO] Start to read j2k main header (0).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Header of tile 1 / 1041 has been read.
[WARNING] Not enough space for expected SOP marker
[WARNING] Not enough space for expected EPH marker
[WARNING] Not enough space for expected SOP marker
[WARNING] Not enough space for expected EPH marker
[WARNING] Not enough space for expected SOP marker
[WARNING] Not enough space for expected EPH marker
...endless

CC: (none) => tarazed25

Comment 6 katnatek 2024-10-02 19:27:46 CEST
Thank you Len

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 7 Thomas Andrews 2024-10-02 21:50:37 CEST
Validating.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 8 Mageia Robot 2024-10-04 07:28:01 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0323.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.