Bug 14122

Summary:	[CVE21] libraw 0.20.2 CVEs found -2
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Vladimir Potapov <v.potapov>
Component:	Preinstalled software in the ISO	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	blocker
Priority:	Highest	CC:	a.proklov, pastordidi, s.matveev
Version:	All	Flags:	v.potapov: qa_verified+ v.potapov: secteam_verified? a.proklov: published+
Target Milestone:	2021.1 Fresh R12
Hardware:	All
OS:	Linux
URL:	CVE-2020-22628,CVE-2020-35533,CVE-2020-35532,CVE-2020-35531,CVE-2020-35534,CVE-2020-35535,CVE-2020-35530
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Vladimir Potapov 2023-12-07 11:40:28 MSK

https://nvd.nist.gov/vuln/detail/CVE-2020-22628 exploit!
https://nvd.nist.gov/vuln/detail/CVE-2020-35533 Base Score: 5.5 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2020-35532 exploit!
https://nvd.nist.gov/vuln/detail/CVE-2020-35531 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2020-35534 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2020-35535 exploit!
https://nvd.nist.gov/vuln/detail/CVE-2020-35530 exploit!

Comment 1 Svyatoslav Matveev 2023-12-07 16:03:49 MSK

********** QA ADVISORY **********

Зарыто патчем CVE-2020-22628.
Остальные касались 0.20-RC2 версии,
в этой версии исправления присутствуют.

*** libraw
**  0.20.2 release +1

https://abf.io/build_lists/4858663
https://abf.io/build_lists/4858664
https://abf.io/build_lists/4858665
https://abf.io/build_lists/4858666
https://abf.io/build_lists/4858667

Comment 2 Dmitry Postnikov 2023-12-07 19:18:15 MSK

*****************************
Обновление отослано в Тестинг

Comment 3 Vladimir Potapov 2023-12-07 19:22:50 MSK

https://security-tracker.debian.org/tracker/CVE-2020-35533
https://security-tracker.debian.org/tracker/CVE-2020-35532
https://security-tracker.debian.org/tracker/CVE-2020-35531
https://security-tracker.debian.org/tracker/CVE-2020-35530
https://security-tracker.debian.org/tracker/CVE-2020-35534

Comment 4 Vladimir Potapov 2023-12-14 17:03:57 MSK

libraw-0.20.2-4
https://abf.io/build_lists/4858663
https://abf.io/build_lists/4858664
https://abf.io/build_lists/4858665
https://abf.io/build_lists/4858666
https://abf.io/build_lists/4858667
************************* Advisory ***************************
CVE closed by patch
**************************************************************
QA Verified