Those problems were announced here: https://www.openwall.com/lists/oss-security/2024/11/09/2 https://www.openwall.com/lists/oss-security/2024/11/12/8
Status comment: (none) => Fixed upstream in future 3.6.1 and patches available from upstreamCVE: (none) => CVE-2024-52530, CVE-2024-52531, CVE-2024-52532Whiteboard: (none) => MGA9TOOSource RPM: (none) => libsoup-3.6.0-1.mga10.src.rpm, libsoup-2.74.3-1.mga9.src.rpm
https://wiki.gnome.org/Projects/libsoup says "This site has been retired. For up to date information, see handbook.gnome.org or gitlab.gnome.org." lib64soup2.4_1 lib64soup3.0_0 https://download.gnome.org/sources/libsoup/ shows: 3.6/ 25-Aug-2024 No sign of any patch here; nor from the openwall CVEs. https://libsoup.gnome.org/libsoup-3.0/index.html looks promising, but its website link is dead and the source link loops. Have to assign this globally.
Assignee: bugsquad => pkg-bugs
Ubuntu has issued advisories on November 27: https://ubuntu.com/security/notices/USN-7126-1 (libsoup2.4) https://ubuntu.com/security/notices/USN-7127-1 (libsoup3)
Source RPM: libsoup-3.6.0-1.mga10.src.rpm, libsoup-2.74.3-1.mga9.src.rpm => libsoup-3.6.0-1.mga10.src.rpm, libsoup2.4-2.74.3-2.mga10.src.rpm, libsoup3-3.4.2-1.mga9.src.rpm, libsoup-2.74.3-1.mga9.src.rpmStatus comment: Fixed upstream in future 3.6.1 and patches available from upstream => Fixed upstream in future 3.6.1 and patches available from upstream and Ubuntu
Suggested advisory: ======================== The updated packages fix security vulnerabilities: GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. (CVE-2024-52530) GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. Input received over the network cannot trigger this. (CVE-2024-52531) GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. (CVE-2024-52532) References: https://www.openwall.com/lists/oss-security/2024/11/09/2 https://www.openwall.com/lists/oss-security/2024/11/12/8 https://ubuntu.com/security/notices/USN-7126-1 https://ubuntu.com/security/notices/USN-7127-1 ======================== Updated packages in core/updates_testing: ======================== lib(64)soup2.4_1-2.74.3-1.1.mga9 lib(64)soup-devel-2.74.3-1.1.mga9 lib(64)soup-gir2.4-2.74.3-1.1.mga9 libsoup-i18n-2.74.3-1.1.mga9 lib(64)soup3.0_0-3.4.2-1.1.mga9 lib(64)soup3-devel-3.4.2-1.1.mga9 lib(64)soup-gir3.0-3.4.2-1.1.mga9 libsoup3-i18n-3.4.2-1.1.mga9 from SRPMS: libsoup-2.74.3-1.1.mga9.src.rpm libsoup3-3.4.2-1.1.mga9.src.rpm
Assignee: pkg-bugs => qa-bugsStatus comment: Fixed upstream in future 3.6.1 and patches available from upstream and Ubuntu => (none)Version: Cauldron => 9Source RPM: libsoup-3.6.0-1.mga10.src.rpm, libsoup2.4-2.74.3-2.mga10.src.rpm, libsoup3-3.4.2-1.mga9.src.rpm, libsoup-2.74.3-1.mga9.src.rpm => libsoup3-3.4.2-1.mga9.src.rpm, libsoup-2.74.3-1.mga9.src.rpmWhiteboard: MGA9TOO => (none)Status: NEW => ASSIGNED
Hmmmm, Bermuda fish chowder, delicious, mouthwatering .....
CC: (none) => herman.viaene
MGA9-64 Plasma Wayland on Compaq H000SB No installation issues. Checked previous update 25642, but found out that previous dependency on shotwell is not listed anymore in # urpmq --whatrequires lib64soup2.4_1 So picked out hardinfo and run it under trace $ strace -o soup.txt hardinfo and trace file shows openat(AT_FDCWD, "/lib64/libsoup-2.4.so.1", O_RDONLY|O_CLOEXEC) = 3 Note: hardinfo seems a quite interesting little tool!! Good to go AFAICS.
Whiteboard: (none) => MGA9-64-OK
Keywords: (none) => advisory
(In reply to Herman Viaene from comment #5) > MGA9-64 Plasma Wayland on Compaq H000SB > No installation issues. > Checked previous update 25642, but found out that previous dependency on > shotwell is not listed anymore in > # urpmq --whatrequires lib64soup2.4_1 But is in urpmq --whatrequires lib64soup3.0_0 installing lib64soup-gir3.0-3.4.2-1.1.mga9.x86_64.rpm libsoup-i18n-2.74.3-1.1.mga9.noarch.rpm lib64soup2.4_1-2.74.3-1.1.mga9.x86_64.rpm lib64soup3.0_0-3.4.2-1.1.mga9.x86_64.rpm libsoup3-i18n-3.4.2-1.1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/5: libsoup3-i18n ################################################################################################## 2/5: lib64soup3.0_0 ################################################################################################## 3/5: libsoup-i18n ################################################################################################## 4/5: lib64soup2.4_1 ################################################################################################## 5/5: lib64soup-gir3.0 ################################################################################################## 1/5: removing lib64soup-gir3.0-3.4.2-1.mga9.x86_64 ################################################################################################## 2/5: removing lib64soup3.0_0-3.4.2-1.mga9.x86_64 ################################################################################################## 3/5: removing lib64soup2.4_1-2.74.3-1.mga9.x86_64 ################################################################################################## 4/5: removing libsoup-i18n-2.74.3-1.mga9.noarch ################################################################################################## 5/5: removing libsoup3-i18n-3.4.2-1.mga9.noarch ################################################################################################## strace gnome-boxes shows openat(AT_FDCWD, "/lib64/libsoup-3.0.so.0", O_RDONLY|O_CLOEXEC) = 3 keep the OK
CC: (none) => andrewsfarm
@Herman: Hardinfo is indeed an interesting tool. Validating.
CC: (none) => sysadmin-bugsKeywords: (none) => validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0382.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED