Bug 14079

Summary:	[CVE21] qemu 7.2.0 CVEs
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Vladimir Potapov <v.potapov>
Component:	Packages from Main	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	critical
Priority:	Highest	CC:	a.proklov, pastordidi
Version:	All	Flags:	v.potapov: qa_verified+ v.potapov: secteam_verified? a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2023-3301,CVE-2023-1386,CVE-2023-3255,CVE-2023-3354,CVE-2023-0664,CVE-2023-1544,CVE-2023-3180,CVE-2023-4135,CVE-2021-20255,CVE-2023-42467,CVE-2023-40360,,CVE-2017-5957
Whiteboard:
Platform:	---	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Vladimir Potapov 2023-12-01 09:00:06 MSK

https://nvd.nist.gov/vuln/detail/CVE-2023-3301 Base Score: 5.6 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-1386 Base Score: 7.8 HIGH
https://nvd.nist.gov/vuln/detail/CVE-2023-3255 Base Score: 6.5 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-3354 Base Score: 7.5 HIGH
https://nvd.nist.gov/vuln/detail/CVE-2023-0664 Base Score: 7.8 HIGH
https://nvd.nist.gov/vuln/detail/CVE-2023-1544 Base Score: 6.3 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-3180 Base Score: 6.5 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-4135 Base Score: 6.5 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2021-20255 Base Score: 5.5 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-42467 Base Score: 5.5 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-40360 Base Score: 5.5 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2017-5957 Base Score: 5.5 MEDIUM

Comment 1 Aleksandr Proklov 2023-12-06 04:08:21 MSK

CVE-2017-5957 непонятно как попал в список, уязвимы версии до 0.6.0
CVE-2023-1386 - отмечен как NOTABUG
CVE-2023-4135 - нет такого кода в версии 7.2
CVE-2023-40360 - нет такого кода в версии 7.2

остальные уязвимости закрыты обновлением версии

qemu	7.2.7-1

https://abf.io/build_lists/4857537
https://abf.io/build_lists/4857538
https://abf.io/build_lists/4857539
https://abf.io/build_lists/4857540

Comment 2 Dmitry Postnikov 2023-12-06 14:42:40 MSK

До сих пор это старье клепаем. Не пора ли 8-ю версию?

Comment 3 Dmitry Postnikov 2023-12-06 19:57:12 MSK

*****************************
Обновление отослано в Тестинг

Comment 4 Aleksandr Proklov 2023-12-07 17:09:41 MSK

(In reply to Dmitry Postnikov from comment #2)
> До сих пор это старье клепаем. Не пора ли 8-ю версию?

ваш коментарий не имеет отношения к теме бага.

Comment 5 Vladimir Potapov 2023-12-14 07:51:43 MSK

qemu-7.2.7-1
https://abf.io/build_lists/4857537
https://abf.io/build_lists/4857538
https://abf.io/build_lists/4857539
https://abf.io/build_lists/4857540
*********************** Advisory **********************
CVEs close by version update
*******************************************************
QA Verified