Bug 13280

Summary:	[CVE 21] ncurses 6.2 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	a.proklov, i.gaptrakhmanov, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2022-29458,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-05-03 18:00:57 MSK

Please patch CVEs for package ncurses version 6.2
  
INFO (CVEs are): ncurses 6.2
 cves found
CVE-2022-29458
Desc: ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-29458
Severity: HIGH
CVE-2023-29491
Desc: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-29491
Severity: HIGH

Comment 1 ilfat 2023-05-25 15:17:23 MSK

********** QA ADVISORY **********

CVE-2022-29458 закрыт патчем

Для ncurses 6.2 патча исправления CVE-2023-29491 пока нет

https://abf.io/build_lists/4444335 aarch64
https://abf.io/build_lists/4444336 i686
https://abf.io/build_lists/4444334 x86_64

Comment 2 Dmitry Postnikov 2023-05-26 11:31:00 MSK

***************************
The update sent to testings

Comment 3 Vladimir Potapov 2023-05-30 18:11:37 MSK

ncurses-6.2-6
https://abf.io/build_lists/4444335 aarch64
https://abf.io/build_lists/4444336 i686
https://abf.io/build_lists/4444334 x86_64
*********************** Advisory **********************
CVE-2022-29458 fix
*******************************************************
QA Verified

Comment 4 Yury 2023-07-25 16:24:16 MSK

Secteam Verified


ждём
CVE-2023-29491

Comment 5 Vladimir Potapov 2023-10-31 15:33:58 MSK

(In reply to Yury from comment #4)
> Secteam Verified
> 
> 
> ждём
> CVE-2023-29491
создал новый баг
https://bugzilla.rosalinux.ru/show_bug.cgi?id=13997

Comment 6 Yury 2023-10-31 15:42:40 MSK

secteam_verified