Bug 34441 - dpkg new security issue CVE-2025-6297
Summary: dpkg new security issue CVE-2025-6297
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-07-08 15:36 CEST by Nicolas Salguero
Modified: 2025-07-11 20:53 CEST (History)
2 users (show)

See Also:
Source RPM: dpkg-1.22.11-1.mga9
CVE: CVE-2025-6297
Status comment: Fixed upstream in 1.22.21


Attachments

Description Nicolas Salguero 2025-07-08 15:36:48 CEST
openSUSE has issued an advisory on July 7:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FNSLEIUKJQUM5CTEBYJAKWDXADY2FDTH/
Nicolas Salguero 2025-07-08 15:37:32 CEST

CVE: (none) => CVE-2025-6297
Status comment: (none) => Fixed upstream in 1.22.21
Whiteboard: (none) => MGA9TOO
Source RPM: (none) => dpkg-1.22.11-3.mga10.src.rpm, dpkg-1.22.11-1.mga9.src.rpm

katnatek 2025-07-10 19:45:13 CEST

Assignee: bugsquad => j.alberto.vc

Comment 1 katnatek 2025-07-10 22:20:41 CEST
RPMS:

dpkg-1.22.21-1.mga9
dpkg-dev-1.22.21-1.mga9
dpkg-devel-1.22.21-1.mga9
dselect-1.22.21-1.mga9
perl-Dpkg-1.22.21-1.mga9

SRPM:
dpkg-1.22.21-1.mga9

Whiteboard: MGA9TOO => (none)
Assignee: j.alberto.vc => qa-bugs
Source RPM: dpkg-1.22.11-3.mga10.src.rpm, dpkg-1.22.11-1.mga9.src.rpm => dpkg-1.22.11-1.mga9
Version: Cauldron => 9

Comment 2 katnatek 2025-07-10 23:01:04 CEST
RH x86_64

installing dpkg-1.22.21-1.mga9.x86_64.rpm dpkg-dev-1.22.21-1.mga9.x86_64.rpm perl-Dpkg-1.22.21-1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/3: perl-Dpkg             ##################################################################################################
      2/3: dpkg                  ##################################################################################################
      3/3: dpkg-dev              ##################################################################################################
      1/3: removing dpkg-dev-1.22.11-1.mga9.x86_64
                                 ##################################################################################################
      2/3: removing perl-Dpkg-1.22.11-1.mga9.noarch
                                 ##################################################################################################
      3/3: removing dpkg-1.22.11-1.mga9.x86_64
                                 ##################################################################################################


LC_ALL=C dpkg-deb --info 'micropython-package-installer_1.0.1_Linux.deb' control
Package: micropython-package-installer
Version: 1.0.1
Section: utils
Priority: optional
Architecture: amd64
Depends: libgtk-3-0, libnotify4, libnss3, libxtst6, xdg-utils, libatspi2.0-0, libdrm2, libgbm1, libxcb-dri3-0, kde-cli-tools | kde-runtime | trash-cli | libglib2.0-bin | gvfs-bin
Recommends: pulseaudio | libasound2
Suggests: gir1.2-gnomekeyring-1.0, libgnome-keyring0, lsb-release
Installed-Size: 290880
Maintainer: Sebastian Romero <s.romero@arduino.cc>
Homepage: https://github.com/sebromero
Description: A tool to install MicroPython packages onto supported Arduino boards.
 A tool to install MicroPython packages onto supported Arduino boards.

Aditional test from bug#30481
 dpkg -c bash_5.2.15-2+b7_amd64.deb
drwxr-xr-x root/root         0 2024-03-29 13:40 ./
drwxr-xr-x root/root         0 2024-03-29 13:40 ./bin/
-rwxr-xr-x root/root   1265648 2024-03-29 13:40 ./bin/bash
drwxr-xr-x root/root         0 2024-03-29 13:40 ./etc/
-rw-r--r-- root/root      1994 2024-03-29 13:40 ./etc/bash.bashrc
drwxr-xr-x root/root         0 2024-03-29 13:40 ./etc/skel/
-rw-r--r-- root/root       220 2024-03-29 13:40 ./etc/skel/.bash_logout
-rw-r--r-- root/root      3526 2024-03-29 13:40 ./etc/skel/.bashrc
-rw-r--r-- root/root       807 2024-03-29 13:40 ./etc/skel/.profile
drwxr-xr-x root/root         0 2024-03-29 13:40 ./usr/
drwxr-xr-x root/root         0 2024-03-29 13:40 ./usr/bin/
-rwxr-xr-x root/root      6865 2024-03-29 13:40 ./usr/bin/bashbug
-rwxr-xr-x root/root     14488 2024-03-29 13:40 ./usr/bin/clear_console
drwxr-xr-x root/root         0 2024-03-29 13:40 ./usr/share/
drwxr-xr-x root/root         0 2024-03-29 13:40 ./usr/share/debianutils/
drwxr-xr-x root/root         0 2024-03-29 13:40 ./usr/share/debianutils/shells.d/
-rw-r--r-- root/root        21 2024-03-29 13:40 ./usr/share/debianutils/shells.d/bash
drwxr-xr-x root/root         0 2024-03-29 13:40 ./usr/share/doc/
drwxr-xr-x root/root         0 2024-03-29 13:40 ./usr/share/doc/bash/
-rw-r--r-- root/root    126824 2022-09-23 08:16 ./usr/share/doc/bash/CHANGES.gz

And more


mkdir deb-test
dpkg -x bash_5.2.15-2+b7_amd64.deb deb-test/

ls -laR deb-test/
deb-test/:
total 36
drwxr-xr-x 5 katnatek katnatek  4096 mar 29  2024 ./
drwx------ 4 katnatek katnatek 20480 jul 10 14:53 ../
drwxr-xr-x 2 katnatek katnatek  4096 jul 10 14:54 bin/
drwxr-xr-x 3 katnatek katnatek  4096 mar 29  2024 etc/
drwxr-xr-x 4 katnatek katnatek  4096 mar 29  2024 usr/

deb-test/bin:
total 1244
drwxr-xr-x 2 katnatek katnatek    4096 jul 10 14:54 ./
drwxr-xr-x 5 katnatek katnatek    4096 mar 29  2024 ../
-rwxr-xr-x 1 katnatek katnatek 1265648 mar 29  2024 bash*
lrwxrwxrwx 1 katnatek katnatek       4 mar 29  2024 rbash -> bash*

And more

rm -rf deb-test/*

dpkg -x micropython-package-installer_1.0.1_Linux.deb deb-test/

ls -laR deb-test/
deb-test/:
total 28
drwxr-xr-x 3 katnatek katnatek  4096 mar 13 09:56 ./
drwx------ 4 katnatek katnatek 20480 jul 10 14:53 ../
drwxr-xr-x 5 katnatek katnatek  4096 mar 13 09:56 usr/

deb-test/usr:
total 20
drwxr-xr-x 5 katnatek katnatek 4096 mar 13 09:56 ./
drwxr-xr-x 3 katnatek katnatek 4096 mar 13 09:56 ../
drwxr-xr-x 2 katnatek katnatek 4096 jul 10 14:56 bin/
drwxr-xr-x 3 katnatek katnatek 4096 mar 13 09:56 lib/
drwxr-xr-x 6 katnatek katnatek 4096 mar 13 09:56 share/

deb-test/usr/bin:
total 12
drwxr-xr-x 2 katnatek katnatek 4096 jul 10 14:56 ./
drwxr-xr-x 5 katnatek katnatek 4096 mar 13 09:56 ../
lrwxrwxrwx 1 katnatek katnatek   66 mar 13 09:56 micropython-package-installer -> ../lib/micropython-package-installer/micropython-package-installer*

And lot more

OK for me

Whiteboard: (none) => MGA9-64-OK
CC: (none) => andrewsfarm

katnatek 2025-07-10 23:06:30 CEST

Keywords: (none) => advisory

Comment 3 Thomas Andrews 2025-07-11 15:04:31 CEST
Validating.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 4 Mageia Robot 2025-07-11 20:53:24 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0204.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.