Bug 777777 – <kde-plasma/discover-5.20.5-r1, <kde-plasma/discover-5.21.3: no verification of link protocol (CVE-2021-28117)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2021-03-22 21:49:44 UTC]

CVE-2021-28117:

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Patch: https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60

[Comment 1 Larry the Git Cow 2021-04-04 13:23:04 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ee5b2b3f04e3e3ee919334c251ae26dce7e761d2

commit ee5b2b3f04e3e3ee919334c251ae26dce7e761d2
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2021-04-04 12:09:16 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2021-04-04 13:19:36 +0000

    kde-plasma/discover: Fix CVE-2021-28117
    
    See also: https://kde.org/info/security/advisory-20210310-1.txt
    
    Bug: https://bugs.gentoo.org/777777
    Package-Manager: Portage-3.0.18, Repoman-3.0.3
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 kde-plasma/discover/discover-5.20.5-r1.ebuild      | 84 ++++++++++++++++++++++
 .../files/discover-5.20.5-CVE-2021-28117.patch     | 28 ++++++++
 2 files changed, 112 insertions(+)

[Comment 2 Thomas Deutschmann (RETIRED) 2021-04-04 16:03:59 UTC]

x86 stable

[Comment 3 Sam James 2021-04-06 19:47:59 UTC]

amd64 done

[Comment 4 Sam James 2021-04-06 19:51:41 UTC]

arm64 done

all arches done

[Comment 5 John Helmert III 2021-04-06 19:57:17 UTC]

Please cleanup.

[Comment 6 Larry the Git Cow 2021-04-06 20:08:16 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=add9c9bd0bc97aa41016081c84cfc968c77ea10a

commit add9c9bd0bc97aa41016081c84cfc968c77ea10a
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2021-04-06 19:56:12 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2021-04-06 20:07:50 +0000

    kde-plasma/discover: Cleanup vulnerable 5.20.5
    
    Bug: https://bugs.gentoo.org/777777
    Package-Manager: Portage-3.0.18, Repoman-3.0.3
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 kde-plasma/discover/discover-5.20.5.ebuild | 82 ------------------------------
 1 file changed, 82 deletions(-)

[Comment 7 NATTkA bot 2021-06-10 15:36:35 UTC]

Unable to check for sanity:

> no match for package: kde-plasma/discover-5.20.5-r1

[Comment 8 Reva Denis 2021-08-31 08:26:14 UTC]

This bug should be marked as resolved maybe?

[Comment 9 John Helmert III 2021-08-31 16:00:15 UTC]

(In reply to Reva Denis from comment #8)
> This bug should be marked as resolved maybe?

Whiteboard at [glsa?] means the bug needs a GLSA vote. I vote no, closing.