[SRU] Thunar CVE-2021-32563 (focal, groovy, hirsute)

[Sean Davis]

[Impact]

CVE-2021-32563 affects Thunar versions found in supported releases.
https://nvd.nist.gov/vuln/detail/CVE-2021-32563

From the CVE:

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.

Related upstream issues:
- https://gitlab.xfce.org/xfce/thunar/-/issues/121
- https://gitlab.xfce.org/xfce/thunar/-/issues/575

The patches required for each supported release can be found here:

1.8.x for focal, groovy:
https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d

4.16.x for hirsute:
https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b
https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664

[Test Plan]

1. Execute `thunar ~/Pictures/icon.png`
2. The default application loads the file.

Expected behavior:
Thunar should instead open, selecting the file.

[Where problems could occur]

Scripts and applications depending on the previous functionality will be adversely affected. Since this functionality (opening the default application instead of navigating to it) is specific to Thunar and not found in other file managers, this change should have minimal regression impact.

[Other Info]

We've done some preliminary work to resolve this issue.

https://github.com/Xubuntu/xubuntu-development/issues/6 with a verification for the fix.

Builds can be found here:
https://launchpad.net/~xubuntu-dev/+archive/ubuntu/sru-staging

[Sean Davis (bluesabre)]

Attaching debdiff for focal.

[Sean Davis (bluesabre)]

Attaching debdiff for groovy.

[Sean Davis (bluesabre)]

Attaching debdiff for hirsute.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[John T (jt252)]

I have confirmed that this bug affects me using Xubuntu 20.10/

[Sean Davis (bluesabre)]

Groovy is now EOL.

[Brian Murray (brian-murray)]

The Hirsute Hippo has reached End of Life, so this bug will not be fixed for that release.