Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 833294 (CVE-2022-0581, CVE-2022-0582, CVE-2022-0583, CVE-2022-0585, CVE-2022-0586) - <net-analyzer/wireshark-3.6.2: Multiple vulnerabilities
Summary: <net-analyzer/wireshark-3.6.2: Multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2022-0581, CVE-2022-0582, CVE-2022-0583, CVE-2022-0585, CVE-2022-0586
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa+]
Keywords:
Depends on: 833632 841884
Blocks:
  Show dependency tree
 
Reported: 2022-02-13 21:25 UTC by Sam James
Modified: 2022-10-16 14:55 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-02-13 21:25:07 UTC
From https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html:

    wnpa-sec-2022-01 RTMPT dissector infinite loop. Issue 17813.

    wnpa-sec-2022-02 Large loops in multiple dissectors. Issue 17829, Issue 17842, Issue 17847, Issue 17855, Issue 17891, Issue 17925, Issue 17926, Issue 17931, Issue 17932, Issue 17933.

    wnpa-sec-2022-03 PVFS dissector crash. Issue 17840.

    wnpa-sec-2022-04 CSN.1 dissector crash. Issue 17882.

    wnpa-sec-2022-05 CMS dissector crash. Issue 17935.
Comment 1 Larry the Git Cow gentoo-dev 2022-02-13 21:27:29 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1130370af81679e2eed1571942b00ca2d30736c

commit f1130370af81679e2eed1571942b00ca2d30736c
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-02-13 21:25:26 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-02-13 21:27:06 +0000

    net-analyzer/wireshark: add 3.6.2
    
    Closes: https://bugs.gentoo.org/833294
    Signed-off-by: Sam James <sam@gentoo.org>

 net-analyzer/wireshark/Manifest               |   1 +
 net-analyzer/wireshark/wireshark-3.6.2.ebuild | 273 ++++++++++++++++++++++++++
 net-analyzer/wireshark/wireshark-9999.ebuild  |   2 +-
 3 files changed, 275 insertions(+), 1 deletion(-)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-15 23:19:27 UTC
CVE-2022-0583:

Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

CVE-2022-0586:

Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

CVE-2022-0581:

Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

CVE-2022-0582:

Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-18 23:00:17 UTC
CVE-2022-0585 (https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0585.json):

Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file
Comment 4 Larry the Git Cow gentoo-dev 2022-10-08 20:44:06 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e3d3daeddc9c5690c9482b49626e8b4bdf20bcfa

commit e3d3daeddc9c5690c9482b49626e8b4bdf20bcfa
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-08 20:43:54 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-08 20:43:54 +0000

    net-analyzer/wireshark: drop 3.6.3, 3.6.6
    
    Bug: https://bugs.gentoo.org/833294
    Bug: https://bugs.gentoo.org/869140
    Signed-off-by: Sam James <sam@gentoo.org>

 net-analyzer/wireshark/Manifest               |   2 -
 net-analyzer/wireshark/wireshark-3.6.3.ebuild | 265 -------------------------
 net-analyzer/wireshark/wireshark-3.6.6.ebuild | 269 --------------------------
 3 files changed, 536 deletions(-)
Comment 5 Larry the Git Cow gentoo-dev 2022-10-08 20:47:08 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=97d0d735c5cd87bd92649af92ac9813441500ad6

commit 97d0d735c5cd87bd92649af92ac9813441500ad6
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-08 20:46:55 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-08 20:46:55 +0000

    net-analyzer/wireshark: drop 3.4.11
    
    Bug: https://bugs.gentoo.org/869140
    Bug: https://bugs.gentoo.org/833294
    Bug: https://bugs.gentoo.org/802216
    Bug: https://bugs.gentoo.org/830343
    Bug: https://bugs.gentoo.org/824474
    Signed-off-by: Sam James <sam@gentoo.org>

 net-analyzer/wireshark/Manifest                |   1 -
 net-analyzer/wireshark/wireshark-3.4.11.ebuild | 285 -------------------------
 2 files changed, 286 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5afc42fac6b85a1784ed825e9428c75b6e2e32b0

commit 5afc42fac6b85a1784ed825e9428c75b6e2e32b0
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-08 20:46:37 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-08 20:46:37 +0000

    profiles/base: mask libvirt[wireshark-plugins] for older libvirt
    
    Bug: https://bugs.gentoo.org/869140
    Bug: https://bugs.gentoo.org/833294
    Bug: https://bugs.gentoo.org/802216
    Bug: https://bugs.gentoo.org/830343
    Bug: https://bugs.gentoo.org/824474
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/base/package.use.mask | 4 ++++
 1 file changed, 4 insertions(+)
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-14 03:28:45 UTC
GLSA request filed
Comment 7 Larry the Git Cow gentoo-dev 2022-10-16 14:45:59 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=e0b5bad8c2504362c0e8f33550615df1018533a8

commit e0b5bad8c2504362c0e8f33550615df1018533a8
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-10-16 14:40:26 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-10-16 14:45:23 +0000

    [ GLSA 202210-04 ] Wireshark: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/802216
    Bug: https://bugs.gentoo.org/824474
    Bug: https://bugs.gentoo.org/830343
    Bug: https://bugs.gentoo.org/833294
    Bug: https://bugs.gentoo.org/869140
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202210-04.xml | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
Comment 8 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-16 14:55:34 UTC
GLSA released, all done!