Multiple vulnerabilities in Bionic, Focal, Jammy and Kinetic

[Luís Infante da Câmara]

The versions in Bionic, Focal, Jammy and Kinetic may be vulnerable to CVE-2018-19351, CVE-2019-9644, CVE-2019-10255, CVE-2019-10856, CVE-2018-21030, CVE-2020-26215, CVE-2021-32798, CVE-2022-24758 and CVE-2022-29238.

Please release patched packages.

[Luís Infante da Câmara (luis220413)]

In Ubuntu 18.04 (bionic), jupyter-notebook has a large test suite (with 252 tests that run on both Python 2 and Python 3) that runs at build time and fails the build if it fails.

[Luís Infante da Câmara (luis220413)]

This patch does not fix CVE-2021-32798.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "jupyter-notebook_bionic.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Luís Infante da Câmara (luis220413)]

A patched package for Focal is in my PPA, but the tests interrupt very quickly, causing the build to fail: https://launchpad.net/~luis220413/+archive/ubuntu/security-updates/+packages

Is an upgrade to 6.4.12 acceptable for a security update for Jammy, given that the package has an extensive testsuite?

[Luís Infante da Câmara (luis220413)]

Today I reported to the upstream project that CVE-2019-10856 is unfixed in the 6.x series.

[Luís Infante da Câmara (luis220413)]

I will file a Debian bug tomorrow.

[Luís Infante da Câmara (luis220413)]

The package builds successfully with this patch.

[Luís Infante da Câmara (luis220413)]

The Debian bug was filed by another person on July 21.

[Marc Deslauriers (mdeslaur)]

In response to comment #4, no, bumping the version isn't acceptable as a security update. Please backport the minimum fixes required to solve the security issues. Thanks!

[Luís Infante da Câmara (luis220413)]

CVE-2019-10856 is unfixed in Kinetic and is pending on a new upstream release including the fix or a security fix by the Debian maintainer. I have filed a bug in the upstream project for this CVE, linked in this bug.

[Luís Infante da Câmara (luis220413)]

Patched source and binary packages are available in my PPA (https://launchpad.net/~luis220413/+archive/ubuntu/security-updates).

[Eduardo Barretto (ebarretto)]

Hi Luis,

could you please provide test results, test plan and instructions?

[Luís Infante da Câmara (luis220413)]

An extensive test suite is run during the build on Ubuntu 18.04, 20.04 and 22.04, and fails the build if it fails. All tests pass or are skipped in these Ubuntu versions.

[Luís Infante da Câmara (luis220413)]

If anyone wants to test this package, please use a version of libjs-moment patched for CVE-2022-24785, that can be obtained from my PPA (https://launchpad.net/~luis220413/+archive/ubuntu/security-updates) and that I expect to be uploaded to the Ubuntu archive soon.

[Luís Infante da Câmara (luis220413)]

Please release the package for Jammy after releasing those in bug #1982617.

[Luís Infante da Câmara (luis220413)]

Note that CVE-2021-32798 is still unpatched in Bionic and Focal. Can we discuss it in the #ubuntu-motu channel in Libera.Chat?

[Luís Infante da Câmara (luis220413)]

Please release the packages for Ubuntu Bionic and Focal, even though CVE-2021-32798 is unfixed for those releases.

[Luís Infante da Câmara (luis220413)]

This is a partial log, but that contains full test results, of running autopkgtest locally with an Ubuntu 22.04 amd64 schroot for the sagemath source package with updated packages from my PPA (https://launchpad.net/~luis220413/+archive/ubuntu/security-updates).

[Luís Infante da Câmara (luis220413)]

The same run for the metakernel source package fails. It is possible that this is not a regression. I am attaching all result files from this run.

[Luís Infante da Câmara (luis220413)]

I have rerun the autopkgtest for the sagemath source package in Ubuntu 22.04. I will attach its logs now.

[Nishit Majithia (0xnishit)]

Hi Luis, I will be checking debdiffs and start working on this sponsoring
Thanks

[Nishit Majithia (0xnishit)]

> Please release the packages for Ubuntu Bionic and Focal, even though CVE-2021-32798 is unfixed
> for those releases.

Hi Luis,

Since CVE-2021-32798 is unfixed in focal and bionic, can you please upload the new debdiffs for these two releases without mentioning this CVE in the changelog, since we don't usually mention anything in the changelog which is **not fixed**

Thanks

[Luís Infante da Câmara (luis220413)]

Could the USN for this update mention that CVE-2021-32798 is unfixed, given its severity?

[Eduardo Barretto (ebarretto)]

USNs only mention fixed CVEs, if CVE-2021-32798 is not mentioned there, you consider it unfixed.
Mentioning it would be more confusing than helpful.

[Launchpad Janitor (janitor)]

This bug was fixed in the package jupyter-notebook - 6.4.8-1ubuntu0.1

---------------
jupyter-notebook (6.4.8-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Crafted link to login page redirects to malicious site
    (LP: #1982670)
    - debian/patches/CVE-2019-10856.patch: Handle empty netloc being
      interpreted as first path part being the netloc by buggy browsers.
    - CVE-2019-10856
  * SECURITY UPDATE: Sensitive information disclosure leading to unauthorized
    access (LP: #1982670)
    - debian/patches/CVE-2022-24758.patch: Log only a non-sensitive subset of
      the headers when a HTTP 5xx error other than HTTP 502 is triggered.
    - CVE-2022-24758
  * SECURITY UPDATE: Access to hidden files or to files in hidden directories
    (LP: #1982670)
    - debian/patches/CVE-2022-29238-1.patch: Add checks for hidden file or path on
      file get.
    - debian/patches/CVE-2022-29238-2.patch: added hidden checks on
      FileContentsManager and accompanying tests.
    - debian/patches/CVE-2022-29238-3.patch: Added hidden checks on
      notebook/services/contents/handlers.py and accompanying tests.
    - debian/patches/CVE-2022-29238-4.patch: Update log message to mention
      hidden directories.
    - debian/patches/CVE-2022-29238-5.patch: Update error messages to not
      mention hidden files.
    - CVE-2022-29238
  * debian/source/lintian-overrides: Update to fix Lintian warnings.

 -- Luís Infante da Câmara <email address hidden> Fri, 29 Jul 2022 21:35:10 +0100