Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 739556 (CVE-2020-24972) - <kde-apps/kleopatra-20.04.3-r1: Unsafe handling of URIs allowing remote code execution (CVE-2020-24972)
Summary: <kde-apps/kleopatra-20.04.3-r1: Unsafe handling of URIs allowing remote code ...
Status: RESOLVED FIXED
Alias: CVE-2020-24972
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-08-29 21:47 UTC by Sam James
Modified: 2020-08-30 21:14 UTC (History)
0 users

See Also:
Package list:
kde-apps/kleopatra-20.04.3-r1
Runtime testing required: ---
nattka: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-08-29 21:47:24 UTC 
Description:
"The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL."

Patch: https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b
Comment 1 Larry the Git Cow gentoo-dev 2020-08-30 07:58:42 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bcbbc28935e68cd159ba8c04fac867cc8f284ce5

commit bcbbc28935e68cd159ba8c04fac867cc8f284ce5
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2020-08-30 07:54:06 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2020-08-30 07:58:22 +0000

    kde-apps/kleopatra: Fix CVE-2020-24972
    
    Bug: https://bugs.gentoo.org/739556
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

 .../files/kleopatra-20.04.3-CVE-2020-24972.patch   | 110 +++++++++++++++++++++
 kde-apps/kleopatra/kleopatra-20.04.3-r1.ebuild     |  57 +++++++++++
 2 files changed, 167 insertions(+)
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-08-30 15:47:24 UTC 
Thanks asturm!
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-08-30 18:36:09 UTC 
arm64 done
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2020-08-30 19:11:45 UTC 
x86 stable
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-08-30 20:28:13 UTC 
amd64 done

all arches done
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-08-30 20:29:58 UTC 
Please cleanup.
Comment 7 Larry the Git Cow gentoo-dev 2020-08-30 20:30:28 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6e2249e0e4b269e1165100fd4c4b8634ba4c124c

commit 6e2249e0e4b269e1165100fd4c4b8634ba4c124c
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2020-08-30 20:30:13 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2020-08-30 20:30:13 +0000

    kde-apps/kleopatra: Cleanup vulnerable 20.04.3 (r0)
    
    Bug: https://bugs.gentoo.org/739556
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

 kde-apps/kleopatra/kleopatra-20.04.3.ebuild | 55 -----------------------------
 1 file changed, 55 deletions(-)
Comment 8 Andreas Sturmlechner gentoo-dev 2020-08-30 20:34:46 UTC 
kde proj done.
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2020-08-30 21:14:48 UTC 
This issue was resolved and addressed in
 GLSA 202008-21 at https://security.gentoo.org/glsa/202008-21
by GLSA coordinator Sam James (sam_c).