Bug 33739 - expat new security issue CVE-2024-50602
Summary: expat new security issue CVE-2024-50602
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-11-08 16:14 CET by Nicolas Salguero
Modified: 2024-11-12 21:27 CET (History)
3 users (show)

See Also:
Source RPM: expat-2.6.3-1.mga9.src.rpm
CVE: CVE-2024-50602
Status comment:


Attachments

Description Nicolas Salguero 2024-11-08 16:14:22 CET
Slackware has issued an advisory on November 7:
https://lwn.net/Articles/997470/
Nicolas Salguero 2024-11-08 16:15:05 CET

CVE: (none) => CVE-2024-50602
Status comment: (none) => Fixed upstream in 2.6.4
Source RPM: (none) => expat-2.6.3-1.mga9.src.rpm
Whiteboard: (none) => MGA9TOO

Comment 1 Nicolas Salguero 2024-11-08 16:28:35 CET
expat-2.6.4-1.mga9 and expat-2.6.4-1.mga10 are building.
Comment 2 Nicolas Salguero 2024-11-09 11:10:28 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. (CVE-2024-50602)

References:
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2024&m=slackware-security.358428
========================

Updated packages in core/updates_testing:
========================
expat-2.6.4-1.mga9
lib(64)expat1-2.6.4-1.mga9
lib(64)expat-devel-2.6.4-1.mga9

from SRPM:
expat-2.6.4-1.mga9.src.rpm

Whiteboard: MGA9TOO => (none)
Status comment: Fixed upstream in 2.6.4 => (none)
Version: Cauldron => 9
Assignee: bugsquad => qa-bugs
Status: NEW => ASSIGNED

katnatek 2024-11-09 19:15:45 CET

Keywords: (none) => advisory

Comment 3 katnatek 2024-11-09 22:56:59 CET
RH x86_64

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (64-bit)" is up-to-date
medium "QA Testing (32-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing //home/katnatek/qa-testing/i586/libexpat1-2.6.4-1.mga9.i586.rpm
//home/katnatek/qa-testing/x86_64/expat-2.6.4-1.mga9.x86_64.rpm
//home/katnatek/qa-testing/x86_64/lib64expat1-2.6.4-1.mga9.x86_64.rpm
Preparing...                     ##################################################################################################
      1/3: lib64expat1           ##################################################################################################
      2/3: expat                 ##################################################################################################
      3/3: libexpat1             ##################################################################################################
      1/3: removing libexpat1-2.6.3-1.mga9.i586
                                 ##################################################################################################
      2/3: removing expat-2.6.3-1.mga9.x86_64
                                 ##################################################################################################
      3/3: removing lib64expat1-2.6.3-1.mga9.x86_64
                                 ##################################################################################################

Followed the procedure from the wiki, as was used in bug#31057 comment#2 (needed test files are attached to bug#31057)

python
Python 3.10.11 (main, Sep 18 2024, 10:39:40) [GCC 12.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.

python testexpat.py 
Tested OK

xmlwf /etc/xml/catalog
xmlwf /etc/passwd
/etc/passwd:1:16: not well-formed (invalid token)

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2024-11-10 20:54:14 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 5 Dan Fandrich 2024-11-12 07:17:07 CET
This package was pushed today but for some reason this bug wasn't automatically closed.

CC: (none) => dan
Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 6 Mageia Robot 2024-11-12 21:27:21 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0362.html

Note You need to log in before you can comment on or make changes to this bug.