| Summary: | jackit security vulnerability CVE-2019-13351 | ||
|---|---|---|---|
| Product: | [ROSA-based products] ROSA Fresh | Reporter: | Zombie Ryushu <zombie.ryushu> |
| Component: | Packages from Main | Assignee: | ROSA Linux Bugs <bugs> |
| Status: | VERIFIED FIXED | QA Contact: | ROSA Linux Bugs <bugs> |
| Severity: | normal | ||
| Priority: | Normal | CC: | alzim, andrey.bondrov, denis.silakov, e.malashin, m.novosyolov, mc2374, pastordidi, v.potapov |
| Version: | All | Flags: | v.potapov:
qa_verified+
m.novosyolov: published+ |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Platform: | 2016.1 | ROSA Vulnerability identifier: | CVE-2019-13351 |
| RPM Package: | jack-1.9.10-4.src.rpm | ISO-related: | |
| Bad POT generating: | Upstream: | ||
| Attachments: |
Report from abi-compliance-checker: libjack from 1.9.10 to 1.9.16
Report from abi-compliance-checker: libjackserver from 1.9.10 to 1.9.16 Report from abi-compliance-checker: libjacknet from 1.9.10 to 1.9.16 |
||
|
Description
Zombie Ryushu
2020-12-07 17:21:11 MSK
Created attachment 5430 [details]
Report from abi-compliance-checker: libjack from 1.9.10 to 1.9.16
Created attachment 5431 [details]
Report from abi-compliance-checker: libjackserver from 1.9.10 to 1.9.16
Created attachment 5432 [details]
Report from abi-compliance-checker: libjacknet from 1.9.10 to 1.9.16
Advisory: Update jack to the latest 1.9.16 release to have the fix for CVE-2019-13351. The same change was pushed to the 2019.1 branch. Of the 3 libraries provided by jack, only libjack.so and libjacknet.so are "safe", according to abi-compliance-checker (see attached reports); however libjackserver.so is not directly used by any other package in 2016.1 (at least according to "urpmq --whatrequires")... Bottom line: no need to rebuild the depending packages. Package for Rosa 2016.1 / Main: https://abf.rosalinux.ru/build_lists/3611267 https://abf.rosalinux.ru/build_lists/3611268 ************************************** The update is sent to expanded testing jack-1.9.16-1 https://abf.rosalinux.ru/build_lists/3611267 https://abf.rosalinux.ru/build_lists/3611268 ******************************** Advisory **************************** Update jack to the latest 1.9.16 release to have the fix for CVE-2019-13351. ********************************************************************** QA Verified |