Bug 829880 – <media-libs/gegl-0.4.34: shell expansion via pathname in system()

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2021-12-23 18:08:54 UTC]

CVE-2021-45463 (https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b):

GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load.


Please bump.

[Comment 1 Larry the Git Cow 2021-12-24 04:45:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f70b4a9075811da1eb30138b756278d8650e9ded

commit f70b4a9075811da1eb30138b756278d8650e9ded
Author:     Sergey Torokhov <[e-mail]>
AuthorDate: 2021-12-23 21:18:16 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-12-24 04:45:13 +0000

    media-libs/gegl: 0.4.34 version bump
    
    Bug: https://bugs.gentoo.org/829880
    
    Signed-off-by: Sergey Torokhov <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 media-libs/gegl/Manifest           |   1 +
 media-libs/gegl/gegl-0.4.34.ebuild | 157 +++++++++++++++++++++++++++++++++++++
 media-libs/gegl/gegl-9999.ebuild   |   2 +-
 3 files changed, 159 insertions(+), 1 deletion(-)

[Comment 2 Sam James 2021-12-24 04:58:04 UTC]

Please stable when ready, thanks!

[Comment 3 Sergey Torokhov 2022-02-25 22:04:18 UTC]

(In reply to Sam James from comment #2)
> Please stable when ready, thanks!

Should I ask to stabilize media-libs/gegl-0.4.34 in separate issue or it's could be done here by security/arches teams?

[Comment 4 Sam James 2022-02-25 22:06:13 UTC]

(In reply to Sergey Torokhov from comment #3)
> (In reply to Sam James from comment #2)
> > Please stable when ready, thanks!
> 
> Should I ask to stabilize media-libs/gegl-0.4.34 in separate issue or it's
> could be done here by security/arches teams?

File a separate bug and have it block this one if that's ok :)

[Comment 5 Sam James 2022-02-25 22:06:30 UTC]

(In reply to Sam James from comment #4)
> (In reply to Sergey Torokhov from comment #3)
> > (In reply to Sam James from comment #2)
> > > Please stable when ready, thanks!
> > 
> > Should I ask to stabilize media-libs/gegl-0.4.34 in separate issue or it's
> > could be done here by security/arches teams?
> 
> File a separate bug and have it block this one if that's ok :)

(Note that for security bugs you do not need to wait 30 days)

[Comment 6 John Helmert III 2022-03-13 17:34:35 UTC]

Please cleanup

[Comment 7 Larry the Git Cow 2022-03-15 04:20:13 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3ed3104af9d0bc7b2aaccaa0a423f0522b91ab10

commit 3ed3104af9d0bc7b2aaccaa0a423f0522b91ab10
Author:     Sergey Torokhov <[e-mail]>
AuthorDate: 2022-03-14 19:18:25 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-03-15 04:05:20 +0000

    media-libs/gegl: drop <gegl-0.4.34, CVE-2021-45463 affected
    
    Bug: https://bugs.gentoo.org/829880
    
    Signed-off-by: Sergey Torokhov <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 media-libs/gegl/Manifest                           |   4 -
 .../files/gegl-0.4.18-drop-failing-tests.patch     |  43 ------
 .../gegl/files/gegl-0.4.18-program-suffix.patch    |  39 -----
 .../files/gegl-0.4.26-fix-build-glib-2.67.3.patch  |  24 ---
 .../files/gegl-0.4.30-fix-build-openexr-3.patch    |  22 ---
 media-libs/gegl/gegl-0.4.26-r1.ebuild              | 167 ---------------------
 media-libs/gegl/gegl-0.4.28.ebuild                 | 167 ---------------------
 media-libs/gegl/gegl-0.4.30.ebuild                 | 161 --------------------
 media-libs/gegl/gegl-0.4.32.ebuild                 | 157 -------------------
 9 files changed, 784 deletions(-)

[Comment 8 jospezial 2023-02-06 07:12:54 UTC]

Can we close this?