Bug 867016 – <dev-util/schroot-1.6.13_p2: denial of schroot service

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-08-27 18:54:44 UTC]

CVE-2022-2787:

Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.

[Comment 1 Georgy Yakovlev 2022-09-17 07:02:43 UTC]

new schroot added.
let's bake it a bit and stabilize in about a week.

[Comment 2 John Helmert III 2022-09-17 16:09:18 UTC]

Thanks!

[Comment 3 John Helmert III 2022-10-04 20:26:37 UTC]

Please cleanup

[Comment 4 Larry the Git Cow 2022-10-10 04:51:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b1e3b136015aeecc30a269e9e907cc055252e547

commit b1e3b136015aeecc30a269e9e907cc055252e547
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2022-10-10 04:51:14 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2022-10-10 04:51:14 +0000

    dev-util/schroot: drop 1.6.10_p12-r2
    
    Bug: https://bugs.gentoo.org/867016
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 dev-util/schroot/Manifest                     |   2 -
 dev-util/schroot/schroot-1.6.10_p12-r2.ebuild | 148 --------------------------
 2 files changed, 150 deletions(-)

[Comment 5 John Helmert III 2022-10-21 18:12:06 UTC]

GLSA request filed

[Comment 6 Larry the Git Cow 2022-10-31 01:41:56 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=50d4eab0aad67c58b06eeda01b8ebe92c11a08c7

commit 50d4eab0aad67c58b06eeda01b8ebe92c11a08c7
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-10-31 01:08:56 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-31 01:40:14 +0000

    [ GLSA 202210-11 ] schroot: Denial of Service
    
    Bug: https://bugs.gentoo.org/867016
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202210-11.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

[Comment 7 John Helmert III 2022-10-31 01:50:46 UTC]

GLSA released, all done!