Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 775323 (CVE-2021-22191, WNPA-SEC-2021-03) - <net-analyzer/wireshark-3.4.4: User-assisted code execution (CVE-2021-22191)
Summary: <net-analyzer/wireshark-3.4.4: User-assisted code execution (CVE-2021-22191)
Status: RESOLVED FIXED
Alias: CVE-2021-22191, WNPA-SEC-2021-03
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://www.wireshark.org/security/wn...
Whiteboard: B3 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-03-11 01:22 UTC by Sam James
Modified: 2021-07-09 02:57 UTC (History)
3 users (show)

See Also:
Package list:
net-analyzer/wireshark-3.4.4
Runtime testing required: ---
nattka: sanity-check-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester gentoo-dev Security 2021-03-11 01:22:55 UTC
Fixed in 3.4.4.

"
    • wnpa-sec-2021-03[1] Wireshark could open unsafe URLs. Issue
      17232[2]. CVE-2021-22191[3].
"
Comment 1 Larry the Git Cow gentoo-dev 2021-03-11 03:57:34 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d6663bd4120a2d12007ed0c20a5a02f94277d9f1

commit d6663bd4120a2d12007ed0c20a5a02f94277d9f1
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2021-03-11 03:56:14 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-03-11 03:56:25 +0000

    net-analyzer/wireshark: add 3.4.4
    
    Bug: https://bugs.gentoo.org/775323
    Signed-off-by: Sam James <sam@gentoo.org>

 net-analyzer/wireshark/Manifest               |   1 +
 net-analyzer/wireshark/wireshark-3.4.4.ebuild | 273 ++++++++++++++++++++++++++
 2 files changed, 274 insertions(+)
Comment 2 John Helmert III gentoo-dev Security 2021-03-24 12:56:20 UTC
I suppose you mean to stable 3.4.4 as the fixed version?
Comment 3 Sam James archtester gentoo-dev Security 2021-03-24 19:42:46 UTC
ppc64 done
Comment 4 Sam James archtester gentoo-dev Security 2021-03-24 19:43:25 UTC
(In reply to John Helmert III from comment #2)
> I suppose you mean to stable 3.4.4 as the fixed version?

yes
Comment 5 Sam James archtester gentoo-dev Security 2021-03-25 23:13:18 UTC
amd64 done
Comment 6 Sam James archtester gentoo-dev Security 2021-03-25 23:15:55 UTC
x86 done
Comment 7 Larry the Git Cow gentoo-dev 2021-03-25 23:22:42 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=46bf94892853f4226f3007331f135184d353487a

commit 46bf94892853f4226f3007331f135184d353487a
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2021-03-25 23:21:48 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-03-25 23:21:50 +0000

    net-analyzer/wireshark: drop 3.4.3 (security cleanup)
    
    Closes: https://bugs.gentoo.org/775323
    Signed-off-by: Sam James <sam@gentoo.org>

 net-analyzer/wireshark/Manifest               |   1 -
 net-analyzer/wireshark/wireshark-3.4.3.ebuild | 273 --------------------------
 2 files changed, 274 deletions(-)
Comment 8 Larry the Git Cow gentoo-dev 2021-03-25 23:25:34 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=87e76517dd8370cc8e0b6e74f2b72b41d704b67f

commit 87e76517dd8370cc8e0b6e74f2b72b41d704b67f
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2021-03-25 23:23:05 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-03-25 23:23:21 +0000

    Revert "net-analyzer/wireshark: drop 3.4.3 (security cleanup)"
    
    This reverts commit 46bf94892853f4226f3007331f135184d353487a.
    Got too excited there...
    
    Bug: https://bugs.gentoo.org/775323
    Signed-off-by: Sam James <sam@gentoo.org>

 net-analyzer/wireshark/Manifest               |   1 +
 net-analyzer/wireshark/wireshark-3.4.3.ebuild | 273 ++++++++++++++++++++++++++
 2 files changed, 274 insertions(+)
Comment 9 Sam James archtester gentoo-dev Security 2021-03-26 11:34:33 UTC
arm64 done
Comment 10 Sam James archtester gentoo-dev Security 2021-03-29 14:49:36 UTC
arm done

all arches done
Comment 11 Sam James archtester gentoo-dev Security 2021-03-29 15:27:18 UTC
Needs cleanup.
Comment 12 Larry the Git Cow gentoo-dev 2021-06-02 20:04:11 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d6a3d8876a75d86ad50abdea987166a023a273d0

commit d6a3d8876a75d86ad50abdea987166a023a273d0
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2021-06-02 20:03:40 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-06-02 20:04:00 +0000

    net-analyzer/wireshark: drop 3.4.3, 3.4.4
    
    Bug: https://bugs.gentoo.org/775323
    Signed-off-by: Sam James <sam@gentoo.org>

 net-analyzer/wireshark/Manifest               |   3 -
 net-analyzer/wireshark/wireshark-3.4.3.ebuild | 273 -------------------------
 net-analyzer/wireshark/wireshark-3.4.4.ebuild | 282 --------------------------
 3 files changed, 558 deletions(-)
Comment 13 NATTkA bot gentoo-dev 2021-06-02 20:08:26 UTC Comment hidden (obsolete)
Comment 14 NATTkA bot gentoo-dev 2021-06-03 01:56:44 UTC
Unable to check for sanity:

> no match for package: net-analyzer/wireshark-3.4.4
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2021-07-09 02:57:02 UTC
This issue was resolved and addressed in
 GLSA 202107-21 at https://security.gentoo.org/glsa/202107-21
by GLSA coordinator Sam James (sam_c).