Summary: | <net-wireless/bluez-5.54: Denial of service/privilege escalation (CVE-2020-0556/INTEL-SA-00352) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Sam James <sam> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | bkohler, pacho, polynomial-c |
Priority: | High | Flags: | stable-bot:
sanity-check+
|
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00352.html | ||
See Also: | https://bugs.gentoo.org/show_bug.cgi?id=919383 | ||
Whiteboard: | B1 [glsa+ cve] | ||
Package list: |
net-wireless/bluez-5.54 amd64 arm arm64 hppa ppc ppc64 x86
dev-libs/ell-0.28 amd64 arm arm64 hppa ppc ppc64 x86
net-wireless/iwd-1.5 amd64 arm arm64 ppc ppc64 x86
|
Runtime testing required: | --- |
Description
Sam James
![]() ![]() ![]() ![]() Looks like patches didn't make it into 5.53 release. (In reply to Thomas Deutschmann from comment #1) > Looks like patches didn't make it into 5.53 release. NOTE: As pointed out [0] on oss-security, these patches do not seem to have landed in time for 5.53, contrary to the advisory(!) I have verified this claim by downloading the tarball and checking for the patches but they do not seem to apply. Note that maintainers can still apply the linked patches. [0] https://www.openwall.com/lists/oss-security/2020/03/13/2 (In reply to sam_c (Security Padawan) from comment #2) > (In reply to Thomas Deutschmann from comment #1) > > Looks like patches didn't make it into 5.53 release. > > > NOTE: As pointed out [0] on oss-security, these patches do not seem to have > landed in time for 5.53, contrary to the advisory(!) > > I have verified this claim by downloading the tarball and checking for the > patches but they do not seem to apply. > > Note that maintainers can still apply the linked patches. > > [0] https://www.openwall.com/lists/oss-security/2020/03/13/2 s/apply/have been applied/. We can try to stabilize 5.54 I think An automated check of this bug failed - repoman reported dependency errors (193 lines truncated):
> dependency.bad net-wireless/bluez/bluez-5.54.ebuild: DEPEND: amd64(default/linux/amd64/17.0) ['>=dev-libs/ell-0.28']
> dependency.bad net-wireless/bluez/bluez-5.54.ebuild: RDEPEND: amd64(default/linux/amd64/17.0) ['>=dev-libs/ell-0.28']
> dependency.bad net-wireless/bluez/bluez-5.54.ebuild: DEPEND: amd64(default/linux/amd64/17.0/desktop) ['>=dev-libs/ell-0.28']
(In reply to Pacho Ramos from comment #4) > We can try to stabilize 5.54 I think Yes please, they've updated the advisory now, so 5.5.4 is the first fixed version. Current stable net-wireless/iwd-1.4 depends on ~ell-0.27, can we add iwd-1.5 stabilization to this list? No known blockers for iwd stable sure amd64 stable arm stable ppc stable ppc64 stable x86 stable dropped to ~hppa (updating whiteboard) New GLSA request filed. This issue was resolved and addressed in GLSA 202003-49 at https://security.gentoo.org/glsa/202003-49 by GLSA coordinator Thomas Deutschmann (whissi). Re-opening for remaining architectures. arm64 stable @maintainer(s), please cleanup cleanup done Tree clean, GLSA done, closing. |