CVE-2017-12652: libpng: does not check length of chunks

[Ghada Khalil]

CVE-2017-12652: libpng: does not check length of chunks

CVSSv2: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Description:
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
Up to (excluding) 1.6.32

References:
https://nvd.nist.gov/vuln/detail/CVE-2017-12652
https://access.redhat.com/errata/RHSA-2020:3901
https://lists.centos.org/pipermail/centos-cr-announce/2020-October/012757.html

Required package version:
libpng-1.5.13-8.el7

[Ghada Khalil (gkhalil)]

Applicable to stx master (aka stx.5.0) as well as stx.4.0.
The process is to address the CVE in stx master first and then cherrypick to the appropriate release branches after some soak time.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/761682

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/761685

[OpenStack Infra (hudson-openstack)]

Change abandoned by Michel Thebeau (WIND) (<email address hidden>) on branch: master
Review: https://review.opendev.org/761685

[OpenStack Infra (hudson-openstack)]

Change abandoned by Michel Thebeau (WIND) (<email address hidden>) on branch: master
Review: https://review.opendev.org/761682

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/761689

[Michel Thebeau [WIND] (mthebeau)]

Merged as: https://review.opendev.org/plugins/gitiles/starlingx/tools/+/596d66bc50dc693f556e2dd99c79fcfb7306580a

[Michel Thebeau [WIND] (mthebeau)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/761689/
Committed: https://opendev.org/starlingx/tools/commit/596d66bc50dc693f556e2dd99c79fcfb7306580a
Submitter: Zuul
Branch: master

commit 596d66bc50dc693f556e2dd99c79fcfb7306580a
Author: Michel Thebeau <email address hidden>
Date: Mon Nov 16 16:12:48 2020 -0500

    libpng: CVE-2017-12652: omits check of chunk len

    libpng does not properly check the length of chunks against the user
    limit.

    Fix is provided by Centos RPMs:
    libpng-1.5.13-8.el7.x86_64.rpm
    libpng-devel-1.5.13-8.el7.x86_64.rpm

    Test:
    Build. Deploy AIO-SX.

    Closes-Bug: 1902993
    Change-Id: Id712d5416bafe331aa4299540c693585e5e181a2
    Signed-off-by: Michel Thebeau <email address hidden>

[Michel Thebeau [WIND] (mthebeau)]

Fix proposed to branch: r/stx.4.0
Review: https://review.opendev.org/c/starlingx/tools/+/764496

[Michel Thebeau [WIND] (mthebeau)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/764496
Committed: https://review.opendev.org/plugins/gitiles/starlingx/tools/+/ca0368edc04f8e143402c22eaf7d22d622049d20
Submitter: Zuul
Branch: r/stx.4.0

commit ca0368edc04f8e143402c22eaf7d22d622049d20
Author: Michel Thebeau <email address hidden>
Date: Mon Nov 16 16:12:48 2020 -0500

    libpng: CVE-2017-12652: omits check of chunk len

    libpng does not properly check the length of chunks against the user
    limit.

    Fix is provided by Centos RPMs:
    libpng-1.5.13-8.el7.x86_64.rpm
    libpng-devel-1.5.13-8.el7.x86_64.rpm

    Test:
    Build. Deploy AIO-SX.

    Closes-Bug: 1902993
    Change-Id: Id712d5416bafe331aa4299540c693585e5e181a2
    Signed-off-by: Michel Thebeau <email address hidden>
    (cherry picked from commit 596d66bc50dc693f556e2dd99c79fcfb7306580a)