[Bug 2212560] New: CVE-2021-43138 yarnpkg: async: Prototype Pollution in async [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2212560
Bug ID: 2212560
Summary: CVE-2021-43138 yarnpkg: async: Prototype Pollution in
async [epel-all]
Product: Fedora EPEL
Version: epel9
Status: NEW
Component: yarnpkg
Keywords: Security, SecurityTracking
Severity: medium
Assignee: zsvetlik(a)redhat.com
Reporter: carl(a)redhat.com
CC: ahanwate(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
extras-qa(a)fedoraproject.org, manisandro(a)gmail.com,
ngompa13(a)gmail.com, zsvetlik(a)redhat.com
Depends On: 2127008
Blocks: 2126276 (CVE-2021-43138)
Target Milestone: ---
Classification: Fedora
+++ This bug was initially created as a clone of Bug #2127008 +++
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--- Additional comment from Avinash Hanwate on 2022-09-15 04:59:15 UTC ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# low, medium, high, urgent (required)
severity=medium
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=2126276,2127008
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--- Additional comment from Fedora Update System on 2023-01-11 15:24:26 UTC ---
FEDORA-2023-ce8943223c has been submitted as an update to Fedora 37.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-ce8943223c
--- Additional comment from Fedora Update System on 2023-01-11 15:24:26 UTC ---
FEDORA-2023-18fd476362 has been submitted as an update to Fedora 36.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-18fd476362
--- Additional comment from Fedora Update System on 2023-01-12 02:41:53 UTC ---
FEDORA-2023-18fd476362 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-18fd476362`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-18fd476362
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--- Additional comment from Fedora Update System on 2023-01-12 03:05:52 UTC ---
FEDORA-2023-ce8943223c has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-ce8943223c`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-ce8943223c
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--- Additional comment from Fedora Update System on 2023-01-21 03:30:27 UTC ---
FEDORA-2023-ce8943223c has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.
--- Additional comment from Fedora Update System on 2023-01-21 03:40:42 UTC ---
FEDORA-2023-18fd476362 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2126276
[Bug 2126276] CVE-2021-43138 async: Prototype Pollution in async
https://bugzilla.redhat.com/show_bug.cgi?id=2127008
[Bug 2127008] CVE-2021-43138 yarnpkg: async: Prototype Pollution in async
[fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212560
11 months, 1 week
[Bug 2209432] New: [abrt] nemo: nemo_icon_view_update_click_to_rename_mode(): nemo-desktop killed by SIGABRT
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2209432
Bug ID: 2209432
Summary: [abrt] nemo:
nemo_icon_view_update_click_to_rename_mode():
nemo-desktop killed by SIGABRT
Product: Fedora
Version: 38
Hardware: x86_64
Status: NEW
Whiteboard: abrt_hash:a66b57b4d022e8183cd101ee78774aa7af54f4a4;VAR
IANT_ID=;
Component: nemo
Assignee: leigh123linux(a)googlemail.com
Reporter: j.lonsdale(a)live.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
leigh123linux(a)googlemail.com, riehecky(a)fnal.gov
Target Milestone: ---
Classification: Fedora
Version-Release number of selected component:
nemo-5.6.4-1.fc38
Additional info:
reporter: libreport-2.17.10
executable: /usr/bin/nemo-desktop
crash_function: nemo_icon_view_update_click_to_rename_mode
cgroup: 0::/user.slice/user-1001.slice/session-12.scope
journald_cursor:
s=bc76317625164f479e38ec4b36a932ef;i=330e;b=f22cec7c550c4bae816b569ad8ece2af;m=1ea272ecb;t=5fc5f09fda81f;x=7c3727809de30007
type: CCpp
runlevel: N 5
rootdir: /
backtrace_rating: 4
cmdline: nemo-desktop
uid: 1001
reason: nemo-desktop killed by SIGABRT
kernel: 6.2.15-300.fc38.x86_64
package: nemo-5.6.4-1.fc38
Truncated backtrace:
Thread no. 1 (12 frames)
#6 nemo_icon_view_update_click_to_rename_mode at ../src/nemo-icon-view.c:2235
#7 nemo_icon_view_update_click_to_rename_mode.isra.0 at
../src/nemo-icon-view.c:2229
#8 g_cclosure_marshal_VOID__STRINGv at ../gobject/gmarshal.c:1462
#9 _g_closure_invoke_va at ../gobject/gclosure.c:895
#12 g_settings_real_change_event at ../gio/gsettings.c:392
#13 _g_cclosure_marshal_BOOLEAN__POINTER_INTv at
../gio/gmarshal-internal.c:428
#14 _g_closure_invoke_va at ../gobject/gclosure.c:895
#17 settings_backend_path_changed at ../gio/gsettings.c:467
#19 g_settings_backend_invoke_closure at ../gio/gsettingsbackend.c:275
#23 g_main_context_iterate.isra.0 at ../glib/gmain.c:4276
#24 g_main_context_iteration at ../glib/gmain.c:4343
#25 g_application_run at ../gio/gapplication.c:2573
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2209432
11 months, 1 week
[Bug 2214573] New: [abrt] cinnamon: module(): cinnamon-subprocess-wrapper:30:<module>:UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe2 in position 124: invalid continuation byte
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2214573
Bug ID: 2214573
Summary: [abrt] cinnamon: module():
cinnamon-subprocess-wrapper:30:<module>:UnicodeDecodeE
rror: 'utf-8' codec can't decode byte 0xe2 in position
124: invalid continuation byte
Product: Fedora
Version: 38
Hardware: x86_64
Status: NEW
Whiteboard: abrt_hash:a652c493b074c454cfd52bc7b885c98aa91b8d48;VAR
IANT_ID=cinnamon;
Component: cinnamon
Assignee: leigh123linux(a)googlemail.com
Reporter: ingobeh(a)hotmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
leigh123linux(a)googlemail.com, miketwebster(a)gmail.com,
riehecky(a)fnal.gov
Target Milestone: ---
Classification: Fedora
Version-Release number of selected component:
cinnamon-5.6.8-2.fc38
Additional info:
reporter: libreport-2.17.10
cmdline: cinnamon-subprocess-wrapper '' '' '' '' '' '' '' '' '' '' '' ''
'' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' ''
'' '' '' '' '' '' ''
reason: cinnamon-subprocess-wrapper:30:<module>:UnicodeDecodeError:
'utf-8' codec can't decode byte 0xe2 in position 124: invalid continuation byte
crash_function: module
package: cinnamon-5.6.8-2.fc38
cgroup: 0::/user.slice/user-1000.slice/session-2.scope
exception_type: UnicodeDecodeError
type: Python3
runlevel: N 5
uid: 1000
interpreter: cinnamon-5.6.8-2.fc38.x86_64
kernel: 6.3.6-200.fc38.x86_64
executable: /usr/bin/cinnamon-subprocess-wrapper
Truncated backtrace:
cinnamon-subprocess-wrapper:30:<module>:UnicodeDecodeError: 'utf-8' codec can't
decode byte 0xe2 in position 124: invalid continuation byte
Traceback (most recent call last):
File "/usr/bin/cinnamon-subprocess-wrapper", line 30, in <module>
GLib.Variant("(isb)", (process_id, result.decode(), success)),
^^^^^^^^^^^^^^^
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe2 in position 124:
invalid continuation byte
Local variables in innermost frame:
__name__: '__main__'
__doc__: ' Runs a command and then passes the output to Cinnamon via DBus
asynchronously\n\nUsage: cinnamon-subprocess-wrapper ls ~/\n'
__package__: None
__loader__: <_frozen_importlib_external.SourceFileLoader object at
0x7fdf5d7f30d0>
__spec__: None
__annotations__: {}
__builtins__: <module 'builtins' (built-in)>
__file__: '/usr/bin/cinnamon-subprocess-wrapper'
__cached__: None
subprocess: <module 'subprocess' from '/usr/lib64/python3.11/subprocess.py'>
sys: <module 'sys' (built-in)>
setproctitle: <built-in function setproctitle>
GLib: <GLibProxyModule <IntrospectionModule 'GLib' from
'/usr/lib64/girepository-1.0/GLib-2.0.typelib'>>
Gio: <GioProxyModule <IntrospectionModule 'Gio' from
'/usr/lib64/girepository-1.0/Gio-2.0.typelib'>>
process_id: 33
result: b'Rang Besitz. Auftrag Datei(en)
Gesamtgr\xc3\xb6\xc3\x9fe\nactive ingo 400 feeling good bro
20230613.pdf \xe2 3404800 Bytes\n'
success: True
connection: <Gio.DBusConnection object at 0x7fdf5c40b500 (GDBusConnection at
0x55f2708fe0d0)>
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2214573
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...
11 months, 1 week