Bug 33732 - python-werkzeug new security issue CVE-2024-49767
Summary: python-werkzeug new security issue CVE-2024-49767
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-11-06 15:49 CET by Nicolas Salguero
Modified: 2024-11-09 06:18 CET (History)
4 users (show)

See Also:
Source RPM: python-werkzeug-3.0.3-1.mga10.src.rpm
CVE: CVE-2024-49767
Status comment: Fixed upstream in 3.0.6 and patch available from upstream


Attachments

Description Nicolas Salguero 2024-11-06 15:49:37 CET
Ubuntu has released an advisory on November 5:
https://ubuntu.com/security/notices/USN-7093-1
Comment 1 Nicolas Salguero 2024-11-06 15:51:19 CET
Fix: https://github.com/pallets/werkzeug/commit/8760275afb72bd10b57d92cb4d52abf759b2f3a7

Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2024-49767
Status comment: (none) => Fixed upstream in 3.0.6 and patch available from upstream
Source RPM: (none) => python-werkzeug-3.0.3-1.mga10.src.rpm

Comment 2 Lewis Smith 2024-11-06 19:38:01 CET
Everything necessary pinpointed!
Assigning to Python stack aintainers.

Assignee: bugsquad => python

Comment 3 David GEIGER 2024-11-07 16:15:09 CET
Assigning to QA,


Packages in 9/Core/Updates_testing:
======================
python3-werkzeug-3.0.6-1.mga9.noarch.rpm

From SRPMS
python-werkzeug-3.0.6-1.mga9.src.rpm

Assignee: python => qa-bugs
CC: (none) => geiger.david68210
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)

katnatek 2024-11-07 19:04:35 CET

Keywords: (none) => advisory

Comment 4 katnatek 2024-11-08 01:39:22 CET
RH x86_54

installing python3-werkzeug-3.0.6-1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: python3-werkzeug      ##################################################################################################
      1/1: removing python3-werkzeug-3.0.3-1.mga9.noarch
                                 ##################################################################################################


OK in base clean install CC to papoteur for additional test

CC: (none) => yvesbrungard

Comment 5 papoteur 2024-11-08 07:47:07 CET
Building a podman image for MADb including the update.
Launching the image
Browsing the application.
No regression found.
OK for me.
Comment 6 katnatek 2024-11-08 18:35:50 CET
(In reply to papoteur from comment #5)
> Building a podman image for MADb including the update.
> Launching the image
> Browsing the application.
> No regression found.
> OK for me.

Thank you

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 7 Thomas Andrews 2024-11-09 02:12:43 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2024-11-09 06:18:48 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0351.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.