Mandriva has issued this advisory today (March 23): http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:036 I don't think Cauldron is vulnerable.
Looks like dmorgan added a patch for this in SVN 7 months ago, but didn't submit it to the build system.
CC: (none) => dmorganec
I've confirmed Cauldron is not vulnerable.
Looks like it was built afterall, but schedbot hadn't marked it in SVN for some reason. No bug had been filed, so here we go. (Confirmed with dmorgan on IRC that this is ready to go.) Advisory: ======================== Updated libsoup packages fix security vulnerability: Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI (CVE-2011-2524). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2524 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:036 ======================== Updated packages in core/updates_testing: ======================== libsoup-2.4-devel-2.32.2-4.1.mga1 libsoup-2.4_1-2.32.2-4.1.mga1 from libsoup-2.32.2-4.1.mga1.src.rpm
Assignee: bugsquad => qa-bugs
Testing complete on i586 for the srpm libsoup-2.32.2-4.1.mga1.src.rpm Just testing using hardinfo under strace, which shows 19734 open("/usr/lib/libsoup-2.4.so.1", O_RDONLY) = 3
CC: (none) => davidwhodgins
Testing for some weeks the lib without issue. Suggested Advisory: ------------- Updated libsoup packages fix security vulnerability: Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI (CVE-2011-2524). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2524 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:036 https://bugs.mageia.org/show_bug.cgi?id=5075 ------------- SRPM: libsoup-2.32.2-4.1.mga1.src.rpm Could sysadmin please push from core/updates_testing to core/updates Thankyou!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Update pushed.
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED