CVE-2015-7529 needs to be backported to supported releases

[Louis Bouchard]

CVE-2015-7529 - predictable tmp files usage available in Xenial needs to be backported to Wily, Vivid and Trusty

[Louis Bouchard (louis)]

This is the original CVE report : https://access.redhat.com/security/cve/cve-2015-7529

[Louis Bouchard (louis)]

Here are the fix for all three version, from the uploaded fix in Xenial.

Smoke test done for all three : it will now create a private directory in /tmp to create the archive

[Louis Bouchard (louis)]

debdiff for trusty

[Louis Bouchard (louis)]

debdiff for vivid

[Louis Bouchard (louis)]

debdiff for wily

[Tyler Hicks (tyhicks)]

sosreport in trusty is also vulnerable to CVE-2014-0246. I'll pull this patch in to fix it:

  https://github.com/sosreport/sos/commit/7b46d346

[Tyler Hicks (tyhicks)]

Hi - I've reviewed, built (with some changes), and tested the debdiffs and now I'm about to publish what I have. The changes that I made are:

 - I didn't feel like the Landscape changes were appropriate for a security update and dropped those patches
   + The SRU process is more appropriate for those changes
   + I considered leaving them in but ultimately decided that I didn't have a way to easily test the changes
 - The versioning needed to be adjusted, the pocket needed to be set to RELEASE-security, and the changelog formatting needed a bit of adjusting, as well
   + See https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging for details
 - The patch descriptions for CVE-2015-7529 were updated to make it clear that 08121d87 "[sosreport] clean up private temporary directory" had also been applied
 - The 14.04 debdiff was updated to fix CVE-2014-0246
 - The 14.04 debdiff for CVE-2015-7529 was missing a description

[Launchpad Janitor (janitor)]

This bug was fixed in the package sosreport - 3.2-2ubuntu0.1

---------------
sosreport (3.2-2ubuntu0.1) vivid-security; urgency=medium

  [ Louis Bouchard ]
  * SECURITY UPDATE: Information disclosure and/or directory traversal
    via insecure tmp file handling (LP: #1525271)
    - debian/patches/0003-CVE-2015-7529.patch: Safely create a private
      tmp directory
    - CVE-2015-7529

 -- Tyler Hicks <email address hidden> Thu, 17 Dec 2015 17:20:56 -0600

[Launchpad Janitor (janitor)]

This bug was fixed in the package sosreport - 3.1-1ubuntu2.2

---------------
sosreport (3.1-1ubuntu2.2) trusty-security; urgency=medium

  * SECURITY UPDATE: Information disclosure via insufficient scrubbing of
    passwords in /etc/fstab
   - debian/patches/0010-CVE-2014-0246.patch: Remove passwords when collecting
     the contents of /etc/fstab
   - CVE-2014-0246

  [ Louis Bouchard ]
  * SECURITY UPDATE: Information disclosure and/or directory traversal
    via insecure tmp file handling (LP: #1525271)
    - debian/patches/0011-CVE-2015-7529.patch: Safely create a private
      tmp directory
    - CVE-2015-7529

 -- Tyler Hicks <email address hidden> Thu, 17 Dec 2015 17:27:05 -0600

[Launchpad Janitor (janitor)]

This bug was fixed in the package sosreport - 3.2-2ubuntu1.1

---------------
sosreport (3.2-2ubuntu1.1) wily-security; urgency=medium

  [ Louis Bouchard ]
  * SECURITY UPDATE: Information disclosure and/or directory traversal
    via insecure tmp file handling (LP: #1525271)
    - debian/patches/0005-CVE-2015-7529.patch: Safely create a private
      tmp directory
    - CVE-2015-7529

 -- Tyler Hicks <email address hidden> Thu, 17 Dec 2015 17:20:51 -0600