Bug 802216 – <net-analyzer/wireshark-3.4.7: DNP dissector crash (CVE-2021-22235)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2021-07-15 03:34:15 UTC]

Description:
"• wnpa-sec-2021-06[1] DNP dissector crash. Issue 17462[2].
      CVE-2021-22235[3]."

[Comment 1 Larry the Git Cow 2021-07-15 03:44:32 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=af43333f245fdcd664de8c138550d217e8fbc0fb

commit af43333f245fdcd664de8c138550d217e8fbc0fb
Author:     Sam James <[e-mail]>
AuthorDate: 2021-07-15 03:44:10 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-07-15 03:44:23 +0000

    net-analyzer/wireshark: add 3.4.7
    
    Bug: https://bugs.gentoo.org/802216
    Signed-off-by: Sam James <[e-mail]>

 net-analyzer/wireshark/Manifest               |   1 +
 net-analyzer/wireshark/wireshark-3.4.7.ebuild | 278 ++++++++++++++++++++++++++
 2 files changed, 279 insertions(+)

[Comment 2 Sam James 2021-07-22 06:06:55 UTC]

arm64 done

[Comment 3 Agostino Sarubbo 2021-07-22 07:09:15 UTC]

amd64 stable

[Comment 4 Sam James 2021-07-23 17:56:42 UTC]

x86 done

[Comment 5 Sam James 2021-07-26 04:36:48 UTC]

ppc64 done

[Comment 6 Sam James 2021-07-30 22:35:52 UTC]

arm done

all arches done

[Comment 7 Larry the Git Cow 2021-08-06 03:43:50 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f6345dd7eedd32252fa376637883300a2658c210

commit f6345dd7eedd32252fa376637883300a2658c210
Author:     Sam James <[e-mail]>
AuthorDate: 2021-08-06 02:58:13 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-08-06 03:41:19 +0000

    net-analyzer/wireshark: drop 3.4.6
    
    Bug: https://bugs.gentoo.org/802216
    Signed-off-by: Sam James <[e-mail]>

 net-analyzer/wireshark/Manifest               |   1 -
 net-analyzer/wireshark/wireshark-3.4.6.ebuild | 278 --------------------------
 2 files changed, 279 deletions(-)

[addCollapseLink(8, 1, 'Toggle comment display'); Comment 8 NATTkA bot 2021-08-14 03:52:31 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: net-analyzer/wireshark-3.4.7

[Comment 9 Larry the Git Cow 2021-12-07 07:15:08 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6ee48442f400b3d264873062440793b81e7b7f04

commit 6ee48442f400b3d264873062440793b81e7b7f04
Author:     Sam James <[e-mail]>
AuthorDate: 2021-12-07 07:14:58 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-12-07 07:14:58 +0000

    net-analyzer/wireshark: drop 3.4.7-r1, 3.4.8
    
    Bug: https://bugs.gentoo.org/802216
    Signed-off-by: Sam James <[e-mail]>

 net-analyzer/wireshark/Manifest                  |   2 -
 net-analyzer/wireshark/wireshark-3.4.7-r1.ebuild | 278 ----------------------
 net-analyzer/wireshark/wireshark-3.4.8.ebuild    | 280 -----------------------
 3 files changed, 560 deletions(-)

[Comment 10 NATTkA bot 2021-12-07 07:20:40 UTC]

Unable to check for sanity:

> no match for package: net-analyzer/wireshark-3.4.7-r1

[Comment 11 Larry the Git Cow 2022-10-08 20:47:07 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=97d0d735c5cd87bd92649af92ac9813441500ad6

commit 97d0d735c5cd87bd92649af92ac9813441500ad6
Author:     Sam James <[e-mail]>
AuthorDate: 2022-10-08 20:46:55 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-10-08 20:46:55 +0000

    net-analyzer/wireshark: drop 3.4.11
    
    Bug: https://bugs.gentoo.org/869140
    Bug: https://bugs.gentoo.org/833294
    Bug: https://bugs.gentoo.org/802216
    Bug: https://bugs.gentoo.org/830343
    Bug: https://bugs.gentoo.org/824474
    Signed-off-by: Sam James <[e-mail]>

 net-analyzer/wireshark/Manifest                |   1 -
 net-analyzer/wireshark/wireshark-3.4.11.ebuild | 285 -------------------------
 2 files changed, 286 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5afc42fac6b85a1784ed825e9428c75b6e2e32b0

commit 5afc42fac6b85a1784ed825e9428c75b6e2e32b0
Author:     Sam James <[e-mail]>
AuthorDate: 2022-10-08 20:46:37 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-10-08 20:46:37 +0000

    profiles/base: mask libvirt[wireshark-plugins] for older libvirt
    
    Bug: https://bugs.gentoo.org/869140
    Bug: https://bugs.gentoo.org/833294
    Bug: https://bugs.gentoo.org/802216
    Bug: https://bugs.gentoo.org/830343
    Bug: https://bugs.gentoo.org/824474
    Signed-off-by: Sam James <[e-mail]>

 profiles/base/package.use.mask | 4 ++++
 1 file changed, 4 insertions(+)

[Comment 12 John Helmert III 2022-10-14 03:28:32 UTC]

GLSA request filed

[Comment 13 Larry the Git Cow 2022-10-16 14:45:57 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=e0b5bad8c2504362c0e8f33550615df1018533a8

commit e0b5bad8c2504362c0e8f33550615df1018533a8
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-10-16 14:40:26 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-16 14:45:23 +0000

    [ GLSA 202210-04 ] Wireshark: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/802216
    Bug: https://bugs.gentoo.org/824474
    Bug: https://bugs.gentoo.org/830343
    Bug: https://bugs.gentoo.org/833294
    Bug: https://bugs.gentoo.org/869140
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202210-04.xml | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

[Comment 14 John Helmert III 2022-10-16 14:55:54 UTC]

GLSA released, all done!