Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 738220 (CVE-2020-24614) - <dev-vcs/fossil-2.12.1: Multiple vulnerabilities (CVE-2020-24614)
Summary: <dev-vcs/fossil-2.12.1: Multiple vulnerabilities (CVE-2020-24614)
Status: RESOLVED FIXED
Alias: CVE-2020-24614
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://www.openwall.com/lists/oss-se...
Whiteboard: B2 [glsa+ cve]
Keywords: CC-ARCHES
Depends on: 738912 738914
Blocks: 675778 690828 724272
  Show dependency tree
 
Reported: 2020-08-20 15:20 UTC by Sam James
Modified: 2020-11-03 00:54 UTC (History)
4 users (show)

See Also:
Package list:
dev-vcs/fossil-2.12.1 amd64 arm x86 dev-db/sqlite-3.33.0 arm arm64 hppa s390 sparc
Runtime testing required: No
nattka: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-08-20 15:20:44 UTC 
"Researcher Max Justicz discovered a potential RCE and other
vulnerabilities in the Fossil distributed version control system.
(https://fossil-scm.org/)  Patches to address these issues are now
available for download.  Package maintainers who bundle Fossil are
encouraged to update their packages without unnecessary delay.

All vulnerabilities require a pre-existing trust relationship between
the victim and the attacker.  In other words, the attacker must be
either a site administrator, or someone with check-in privileges on
the project.  There are no known vulnerabilities to servers from web
users entering tickets or forum messages or wiki or doing other
on-line operations.  The attacks require the ability to push, at
least, and the most serious RCE problem requires the ability to
configure a server in malicious ways.  If you are unable to upgrade to
one of the patched versions of Fossil, then you are encouraged at
least to know well the people from whom you clone or pull.

Precompiled binaries and source tarballs for the patched versions of
Fossil are available on the Fossil download page
(http://fossil-scm.org/fossil/uv/download.html).  However, the dozens
of check-ins that went into generating these patches, and the tickets
that describe the specifics of the vulnerabilities, will be embargoed
for a few days.

See the thread on the Fossil Forum
(https://fossil-scm.org/forum/info/a05ae3ce7760daf6) for follow up
information or to communicate directly with the Fossil developers."
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-08-20 15:21:32 UTC 
Maintainers, please bump to 2.12.1 immediately.
Comment 2 Larry the Git Cow gentoo-dev 2020-08-22 01:35:39 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fdd530e64ec81f3c15358ae287fa1145219c79fe

commit fdd530e64ec81f3c15358ae287fa1145219c79fe
Author:     Georgy Yakovlev <gyakovlev@gentoo.org>
AuthorDate: 2020-08-22 01:33:21 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2020-08-22 01:35:25 +0000

    dev-vcs/fossil: security bump to 2.12.1
    
    Bug: https://bugs.gentoo.org/738220
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Requested-by: Rafael G. Martins <rafaelmartins@gentoo.org>
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 dev-vcs/fossil/Manifest             |  1 +
 dev-vcs/fossil/fossil-2.12.1.ebuild | 72 +++++++++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+)
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-08-23 00:22:11 UTC 
Maintainers, let us know when ready to stable.
Comment 4 Rafael Martins (RETIRED) gentoo-dev 2020-08-24 00:00:26 UTC 
please stabilize
Comment 5 Sergei Trofimovich (RETIRED) gentoo-dev 2020-09-07 20:59:15 UTC 
ppc64 stable
Comment 6 Sergei Trofimovich (RETIRED) gentoo-dev 2020-09-08 07:03:07 UTC 
ppc stable
Comment 7 Larry the Git Cow gentoo-dev 2020-09-23 10:39:32 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e716de587da3cd501a0c83259d0e1a14771b3d24

commit e716de587da3cd501a0c83259d0e1a14771b3d24
Author:     Aaron W. Swenson <titanofold@gentoo.org>
AuthorDate: 2020-09-23 10:36:03 +0000
Commit:     Aaron W. Swenson <titanofold@gentoo.org>
CommitDate: 2020-09-23 10:39:16 +0000

    dev-vcs/fossil: Bump sqlite dep, drop legacy-mv-rm
    
    Fossil 2.12 requires SQLite 3.33.0 when using the system installation.
    
    Dropped the legacy-mv-rm use flag as upstream removed it in 2.12.1. Further, it
    has always been enabled since 2.7, but still requires mv-rm to be activated in
    each repo.
    
    Reverted ppc and ppc64 stabilizations given the two previous items would prevent
    successful emerging if enabled, so need to be rechecked.
    
    Bug: https://bugs.gentoo.org/738220
    Closes: https://bugs.gentoo.org/738914
    Closes: https://bugs.gentoo.org/738912
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Signed-off-by: Aaron W. Swenson <titanofold@gentoo.org>

 dev-vcs/fossil/fossil-2.12.1.ebuild | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)
Comment 8 NATTkA bot gentoo-dev 2020-09-23 10:44:59 UTC 
Sanity check failed:

> dev-vcs/fossil-2.12.1
>   depend amd64 stable profile default/linux/amd64/17.0 (59 total)
>     >=dev-db/sqlite-3.33.0:3
>   depend amd64 dev profile default/linux/amd64/17.0/no-multilib/prefix/kernel-3.2+ (35 total)
>     >=dev-db/sqlite-3.33.0:3
>   rdepend amd64 stable profile default/linux/amd64/17.0 (59 total)
>     >=dev-db/sqlite-3.33.0:3
>   rdepend amd64 dev profile default/linux/amd64/17.0/no-multilib/prefix/kernel-3.2+ (35 total)
>     >=dev-db/sqlite-3.33.0:3
Comment 9 Sergei Trofimovich (RETIRED) gentoo-dev 2020-09-24 18:58:22 UTC 
ppc/ppc64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2020-09-25 08:47:01 UTC 
x86 stable
Comment 11 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-09-25 16:21:39 UTC 
arm64 done
Comment 12 Rolf Eike Beer archtester 2020-09-30 18:39:43 UTC 
sparc stable
Comment 13 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-10-01 11:11:27 UTC 
arm done
Comment 14 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-10-01 19:47:32 UTC 
amd64 done
Comment 15 Larry the Git Cow gentoo-dev 2020-10-02 03:40:04 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f16b344c51b67da95e31e077c4b5a2092788ef0f

commit f16b344c51b67da95e31e077c4b5a2092788ef0f
Author:     Aaron W. Swenson <titanofold@gentoo.org>
AuthorDate: 2020-10-02 03:37:22 +0000
Commit:     Aaron W. Swenson <titanofold@gentoo.org>
CommitDate: 2020-10-02 03:37:22 +0000

    dev-vcs/fossil: Cleanup
    
    Bug: https://bugs.gentoo.org/738220
    Closes: https://bugs.gentoo.org/724272
    Closes: https://bugs.gentoo.org/675778
    Closes: https://bugs.gentoo.org/690828
    Signed-off-by: Aaron W. Swenson <titanofold@gentoo.org>

 dev-vcs/fossil/Manifest             |  1 -
 dev-vcs/fossil/fossil-2.11.1.ebuild | 72 -------------------------------------
 dev-vcs/fossil/metadata.xml         |  3 --
 3 files changed, 76 deletions(-)
Comment 16 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-10-04 13:55:51 UTC 
@hppa, s390: stable if you wish?
Comment 17 Agostino Sarubbo gentoo-dev 2020-10-07 06:56:10 UTC 
s390 stable
Comment 18 Rolf Eike Beer archtester 2020-10-11 12:12:53 UTC 
hppa done. All arches done.
Comment 19 GLSAMaker/CVETool Bot gentoo-dev 2020-11-03 00:54:09 UTC 
This issue was resolved and addressed in
 GLSA 202011-04 at https://security.gentoo.org/glsa/202011-04
by GLSA coordinator Sam James (sam_c).