Bug 13538

Summary:	[CVE 21] hivex 1.3.20 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	a.proklov, e.kosachev, i.gaptrakhmanov, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2021-3622,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-08-24 00:20:34 MSK

Please patch CVEs for package hivex version 1.3.20
  
INFO (CVEs are): hivex 1.3.20
 cves found
CVE-2021-3622
Desc: A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3622
Severity: MEDIUM

Comment 1 ilfat 2023-09-13 14:09:30 MSK

********** QA ADVISORY **********

CVEs closed by project update: 1.3.20 --> 1.3.23

https://abf.rosalinux.ru/build_lists/4683604 aarch64
https://abf.rosalinux.ru/build_lists/4683603 x86_64
https://abf.rosalinux.ru/build_lists/4683602 i686
https://abf.rosalinux.ru/build_lists/4683605 riscv64

Comment 2 Dmitry Postnikov 2023-09-14 13:56:19 MSK

***************************
The update sent to testings

Comment 3 Vladimir Potapov 2023-09-19 06:40:18 MSK

hivex-1.3.23-4
https://abf.rosalinux.ru/build_lists/4683604 aarch64
https://abf.rosalinux.ru/build_lists/4683603 x86_64
https://abf.rosalinux.ru/build_lists/4683602 i686
https://abf.rosalinux.ru/build_lists/4683605 riscv64
***************************** Advisory ***************************
CVEs closed by project update: 1.3.20 --> 1.3.23
******************************************************************
QA Verified

Comment 4 Yury 2023-10-19 15:09:29 MSK

secteam_verified