arbitrary code execution in compare_versions

[Marc Deslauriers]

From DSA 2997-1:

Jakub Wilk discovered a remote command execution flaw in reportbug, a
tool to report bugs in the Debian distribution. A man-in-the-middle
attacker could put shell metacharacters in the version number allowing
arbitrary code execution with the privileges of the user running
reportbug.

[Scott Kitterman (kitterman)]

I decided it would be better to version/use debian/changelog from Debian in Trusty as well for consistency of the versioning with Debian. Since there are no other changes, it seemed the most sane way to go about it.

[Scott Kitterman (kitterman)]

Uploaded for Utopic.

[Launchpad Janitor (janitor)]

This bug was fixed in the package reportbug - 6.3.1ubuntu1.1

---------------
reportbug (6.3.1ubuntu1.1) precise-security; urgency=medium

  * SECURITY UPDATE: arbitrary code execution in compare_versions
    (LP: #1353046)
    - reportbug/checkversions.py: don't use os.system to compare versions.
    - reportbug/__init__.py: update version number.
    - CVE-2014-0479
 -- Marc Deslauriers <email address hidden> Tue, 05 Aug 2014 14:52:52 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package reportbug - 6.5.0+nmu1ubuntu0.1

---------------
reportbug (6.5.0+nmu1ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE:
  * References
  * CVE-2014-0479
  * LP: #1353046
  * Merge from Debian unstable. Remaining changes:
    - bin/reportbug: If bts=ubuntu or unconfigured, exit with an
      an error and refer user "ubuntu-bug" instead.
    - reportbug/__init__.py: Match reportbug version with package version.
    - debian/control: Add prominent note to package description.
    - debian/rules, debian/dirs: Do not install .desktop file.
 -- Scott Kitterman <email address hidden> Tue, 05 Aug 2014 14:49:52 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package reportbug - 6.5.0+nmu1ubuntu2

---------------
reportbug (6.5.0+nmu1ubuntu2) utopic; urgency=medium

  * Use 6.5.0 as version to match release regex that excludes +nmu.

reportbug (6.5.0+nmu1ubuntu1) utopic; urgency=medium

  * Merge from Debian unstable. Remaining changes (LP: #1353046):
    - bin/reportbug: If bts=ubuntu or unconfigured, exit with an
      an error and refer user "ubuntu-bug" instead.
    - reportbug/__init__.py: Match reportbug version with package version.
    - debian/control: Add prominent note to package description.
    - debian/rules, debian/dirs: Do not install .desktop file.

reportbug (6.5.0+nmu1) unstable; urgency=high

  * Non-maintainer upload.
  * CVE-2014-0479: Arbitrary code execution in compare_versions.
    A man-in-the-middle attacker could put shell metacharacters in the
    version number, causing execution of code of their choice.
    Thanks to Jakub Wilk <email address hidden>
 -- Scott Kitterman <email address hidden> Tue, 05 Aug 2014 15:19:08 -0400

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".