Bug 563504 – <dev-libs/libreport-2.0.13: Possible private data leak in Bugzilla bugs opened by ABRT

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2015-10-19 14:48:19 UTC]

From ${URL} :

A bug was found in libreport which causes that user's changes made to reported data are thrown 
away. Only the changes to the first file in the list are saved and the rest is discarded. It means 
that Bugzilla attachments can contain data that user wanted to remove.

The affected files are:
- backtrace
- cmdline (/proc/[pid]/cmdline)
- environ (/proc/[pid]/environ)
- open_fds (/proc/[pid]/{fd,fdinfo})
- maps (/proc/[pid]/maps)
- smaps (/proc/[pid]/smaps)
- hostname
- remote ("1" if the problem directory was uploaded from another host)
- ks.cfg (Anaconda's ks.cfg file)
- anaconda-tb

[Comment 1 Thomas Deutschmann (RETIRED) 2016-11-22 14:51:43 UTC]

Upstream fix: https://github.com/abrt/libreport/commit/257578a23d1537a2d235aaa2b1488ee4f818e360

Included since v2.6.3.


@ Maintainer(s): Please bump to >=dev-libs/libreport-2.6.3

[Comment 2 Pacho Ramos 2017-09-20 17:36:51 UTC]

bugzilla plugin is disabled in our package with libreport-2.0.13-gentoo.patch

[Comment 3 Christopher Díaz Riveros (RETIRED) 2017-09-20 17:59:00 UTC]

Thank you Pacho, that's very helpful info.

@Security please vote and add CVE

Gentoo Security Padawan
ChrisADR

[Comment 4 Aaron Bauman (RETIRED) 2017-09-24 21:00:10 UTC]

GLSA Vote: No