Debian Bug report logs -
#1010264
CVE-2022-28391
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, Theodore Y. Ts'o <tytso@mit.edu>
:
Bug#1010264
; Package e2fsprogs
.
(Wed, 27 Apr 2022 11:57:05 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Muehlenhoff <jmm@debian.org>
:
New Bug report received and forwarded. Copy sent to Theodore Y. Ts'o <tytso@mit.edu>
.
(Wed, 27 Apr 2022 11:57:05 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Package: e2fsprogs
Version: 1.46.5-2
Severity: important
This issue was found by Alpine:
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661
Details and the patches they used are in the report above, but the
patches are not yet merged upstream, might be worth to wait until
that's fixed since the impact is rather low.
Cheers,
Moritz
Bug reassigned from package 'e2fsprogs' to 'src:busybox'.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Wed, 27 Apr 2022 12:09:03 GMT) (full text, mbox, link).
No longer marked as found in versions e2fsprogs/1.46.5-2.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Wed, 27 Apr 2022 12:09:03 GMT) (full text, mbox, link).
Added tag(s) security and upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Wed, 27 Apr 2022 12:09:04 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian Install System Team <debian-boot@lists.debian.org>
:
Bug#1010264
; Package src:busybox
.
(Thu, 28 Apr 2022 03:33:03 GMT) (full text, mbox, link).
Acknowledgement sent
to "Theodore Ts'o" <tytso@mit.edu>
:
Extra info received and forwarded to list. Copy sent to Debian Install System Team <debian-boot@lists.debian.org>
.
(Thu, 28 Apr 2022 03:33:03 GMT) (full text, mbox, link).
Message #16 received at 1010264@bugs.debian.org (full text, mbox, reply):
On Wed, Apr 27, 2022 at 01:55:27PM +0200, Moritz Muehlenhoff wrote:
> Package: e2fsprogs
> Version: 1.46.5-2
> Severity: important
>
> This issue was found by Alpine:
> https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661
>
> Details and the patches they used are in the report above, but the
> patches are not yet merged upstream, might be worth to wait until
> that's fixed since the impact is rather low.
Um, going to that link results in the (closed) alpine bug from three
weeks ago:
"netstat is vulnerable to escape sequence injection (busybox)"
"Alpine ships BusyBox with the netstat applet enabled. This is
vulnerable to escape sequence injection when used from an VT
compatible terminal. To exploit this vulnerability the PTR for a
remote host must contain a escape sequence and the victim has to
execute netstat. I've set up an example at [elided] with the PTR
resolving to \027[33\;46mlocalhost."
The string "e2fsprogs" appears nowhere in on the page.
I've done a search on Alpine/aports looking for "e2fsprogs" and could
only find:
e2fsprogs can be uninstalled manually on systems that depend on it
#13584 · created 1 month ago by Álvaro Torralba
updated 1 month ago
modloop verification fails with apline usb drive when local disk partition has a alpine installation
#11136 · created 2 years ago by nico
Neither seems to be security related. Are you sure this was correctly
filed against e2fsprogs?
- Ted
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian Install System Team <debian-boot@lists.debian.org>
:
Bug#1010264
; Package src:busybox
.
(Thu, 28 Apr 2022 07:09:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Muehlenhoff <jmm@inutil.org>
:
Extra info received and forwarded to list. Copy sent to Debian Install System Team <debian-boot@lists.debian.org>
.
(Thu, 28 Apr 2022 07:09:03 GMT) (full text, mbox, link).
Message #21 received at 1010264@bugs.debian.org (full text, mbox, reply):
On Wed, Apr 27, 2022 at 11:29:00PM -0400, Theodore Ts'o wrote:
> Neither seems to be security related. Are you sure this was correctly
> filed against e2fsprogs?
Apologies, I reported multiple incoming new issues from the CVE feed
and I must have mis-pasted the wrong Emacs buffer into the report.
The correct references are
https://bugzilla.redhat.com/show_bug.cgi?id=2069726
https://bugzilla.redhat.com/show_bug.cgi?id=2068113
And the proposed patch was already posted at:
https://lore.kernel.org/linux-ext4/20220421173148.20193-1-lczerner@redhat.com/T/#u
Cheers,
Moritz
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian Install System Team <debian-boot@lists.debian.org>
:
Bug#1010264
; Package src:busybox
.
(Thu, 28 Apr 2022 07:33:06 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Extra info received and forwarded to list. Copy sent to Debian Install System Team <debian-boot@lists.debian.org>
.
(Thu, 28 Apr 2022 07:33:06 GMT) (full text, mbox, link).
Message #26 received at 1010264@bugs.debian.org (full text, mbox, reply):
Hi,
On Thu, Apr 28, 2022 at 09:04:52AM +0200, Moritz Muehlenhoff wrote:
> On Wed, Apr 27, 2022 at 11:29:00PM -0400, Theodore Ts'o wrote:
> > Neither seems to be security related. Are you sure this was correctly
> > filed against e2fsprogs?
>
> Apologies, I reported multiple incoming new issues from the CVE feed
> and I must have mis-pasted the wrong Emacs buffer into the report.
>
> The correct references are
> https://bugzilla.redhat.com/show_bug.cgi?id=2069726
> https://bugzilla.redhat.com/show_bug.cgi?id=2068113
>
> And the proposed patch was already posted at:
> https://lore.kernel.org/linux-ext4/20220421173148.20193-1-lczerner@redhat.com/T/#u
Theodore, btw the BTS reference for the e2fsprogs issue is #1010263
and the CVE id CVE-2022-1304.
#1010264 and CVE-2022-28391 is respectively for busybox. the bug
already reassigned accordingly earlier.
Regards,
Salvatore
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Thu Apr 28 13:10:39 2022;
Machine Name:
bembo
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.