10451 2020-02-09 13:28:11 +0300 systemd: fixed CVE-2020-1712, fixed /etc/pam.d/systemd-user, user() and group() provides generators 2020-02-26 18:30:23 +0300 1 1 2 ROSA-based products ROSA Fresh System (kernel, glibc, systemd, bash, PAM...) All All Linux VERIFIED FIXED Normal normal --- 1 m.novosyolov bugs andrey.bondrov pastordidi v.potapov --- oldest_to_newest 56144 0 m.novosyolov 2020-02-09 13:28:11 +0300 ******* QA ADVISORY ******** systemd 243-24: - backported fixes of CVE-2020-1712 (http://www.opennet.ru/opennews/art.shtml?num=52340) - expose new API function sd_bus_enqueue_for_read() - cherry-picked its description into mans https://abf.io/build_lists/3202615 https://abf.io/build_lists/3202616 56146 1 m.novosyolov 2020-02-09 18:29:49 +0300 ******* QA ADVISORY ******** systemd 243-24: - backported fixes of CVE-2020-1712 (http://www.opennet.ru/opennews/art.shtml?num=52340) - removed d_bus_enqeue_for_read() from public API because in previous version where d_bus_enqeue_for_read() was put under LIBSYSTEMD_243 binaries built on ROSA could not run on other distros, e.g. Ubuntu, where d_bus_enqeue_for_read() was under LIBSYSTEMD_245: test program sd.c: #include <systemd/sd-bus.h> int main(){ sd_bus_enqueue_for_read(NULL, NULL); } $ gcc -I/usr/include sd.c -lsystemd -o sd.bin $ ./sd.bin - runs ok on ROSa, but on Ubuntu: $ ./sd.bin ./sd.bin: symbol lookup error: ./sd.bin: undefined symbol: sd_bus_enqueue_for_read, version LIBSYSTEMD_243 So I just removed d_bus_enqeue_for_read() from public API systemd-stable did the same: https://github.com/systemd/systemd-stable/commit/83bfc0d8dd026814d23e3fdfa46806394f775526 > zjs: patch modified to not make the function public ********************************** https://abf.io/build_lists/3202697 https://abf.io/build_lists/3202698 56147 2 m.novosyolov 2020-02-09 20:03:17 +0300 Fixed mistake: function was not removed from a public header and was not really hidden, removed it https://abf.io/build_lists/3202726 https://abf.io/build_lists/3202727 56163 3 m.novosyolov 2020-02-13 02:02:58 +0300 More other fixes ******** QA ADVISORY ******** - (previous) Ported fix of CVE-2020-1712, no new public API is introduced - (new) Fixed /etc/pam.d/systemd-user: restored inclusion of /etc/pam.d/systemd-auth in /etc/pam.d/systemd-user (it was lost when updating from 230 to 243) - (new) Added user() and group() RPM provides generators from Fedora which parse sysusersd configs https://abf.io/build_lists/3204870 https://abf.io/build_lists/3204871 56179 4 pastordidi 2020-02-17 10:20:37 +0300 The update is sent to expanded testing *************************************** 56252 5 v.potapov 2020-02-26 12:44:20 +0300 systemd-243-32 https://abf.io/build_lists/3204870 https://abf.io/build_lists/3204871 **************************** Advisory **************************** - (previous) Ported fix of CVE-2020-1712, no new public API is introduced - (new) Fixed /etc/pam.d/systemd-user: restored inclusion of /etc/pam.d/systemd-auth in /etc/pam.d/systemd-user (it was lost when updating from 230 to 243) - (new) Added user() and group() RPM provides generators from Fedora which parse sysusersd configs ****************************************************************** QA Verified