| Summary: | systemd: fixed CVE-2020-1712, fixed /etc/pam.d/systemd-user, user() and group() provides generators | ||
|---|---|---|---|
| Product: | [ROSA-based products] ROSA Fresh | Reporter: | Mikhail Novosyolov <m.novosyolov> |
| Component: | System (kernel, glibc, systemd, bash, PAM...) | Assignee: | ROSA Linux Bugs <bugs> |
| Status: | VERIFIED FIXED | ||
| Severity: | normal | CC: | andrey.bondrov, pastordidi, v.potapov |
| Priority: | Normal | Flags: | v.potapov:
qa_verified+
andrey.bondrov: published+ |
| Version: | All | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Platform: | --- | ROSA Vulnerability identifier: | |
| RPM Package: | Upstream: | ||
|
Description
Mikhail Novosyolov
2020-02-09 13:28:11 MSK
******* QA ADVISORY ******** systemd 243-24: - backported fixes of CVE-2020-1712 (http://www.opennet.ru/opennews/art.shtml?num=52340) - removed d_bus_enqeue_for_read() from public API because in previous version where d_bus_enqeue_for_read() was put under LIBSYSTEMD_243 binaries built on ROSA could not run on other distros, e.g. Ubuntu, where d_bus_enqeue_for_read() was under LIBSYSTEMD_245: test program sd.c: #include <systemd/sd-bus.h> int main(){ sd_bus_enqueue_for_read(NULL, NULL); } $ gcc -I/usr/include sd.c -lsystemd -o sd.bin $ ./sd.bin - runs ok on ROSa, but on Ubuntu: $ ./sd.bin ./sd.bin: symbol lookup error: ./sd.bin: undefined symbol: sd_bus_enqueue_for_read, version LIBSYSTEMD_243 So I just removed d_bus_enqeue_for_read() from public API systemd-stable did the same: https://github.com/systemd/systemd-stable/commit/83bfc0d8dd026814d23e3fdfa46806394f775526 > zjs: patch modified to not make the function public ********************************** https://abf.io/build_lists/3202697 https://abf.io/build_lists/3202698 Fixed mistake: function was not removed from a public header and was not really hidden, removed it https://abf.io/build_lists/3202726 https://abf.io/build_lists/3202727 More other fixes ******** QA ADVISORY ******** - (previous) Ported fix of CVE-2020-1712, no new public API is introduced - (new) Fixed /etc/pam.d/systemd-user: restored inclusion of /etc/pam.d/systemd-auth in /etc/pam.d/systemd-user (it was lost when updating from 230 to 243) - (new) Added user() and group() RPM provides generators from Fedora which parse sysusersd configs https://abf.io/build_lists/3204870 https://abf.io/build_lists/3204871 The update is sent to expanded testing *************************************** systemd-243-32 https://abf.io/build_lists/3204870 https://abf.io/build_lists/3204871 **************************** Advisory **************************** - (previous) Ported fix of CVE-2020-1712, no new public API is introduced - (new) Fixed /etc/pam.d/systemd-user: restored inclusion of /etc/pam.d/systemd-auth in /etc/pam.d/systemd-user (it was lost when updating from 230 to 243) - (new) Added user() and group() RPM provides generators from Fedora which parse sysusersd configs ****************************************************************** QA Verified |