From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id MEtANQWIVGAMEQAA0tVLHw (envelope-from ) for ; Fri, 19 Mar 2021 11:16:21 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id mK0pMQWIVGDUJwAAB5/wlQ (envelope-from ) for ; Fri, 19 Mar 2021 11:16:21 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 28929114CF for ; Fri, 19 Mar 2021 12:16:21 +0100 (CET) Received: from localhost ([::1]:38752 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lND76-0005f8-4N for larch@yhetil.org; Fri, 19 Mar 2021 07:16:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33082) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lND6o-0005eg-RA for bug-guix@gnu.org; Fri, 19 Mar 2021 07:16:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:37383) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lND6o-0003qn-Jc for bug-guix@gnu.org; Fri, 19 Mar 2021 07:16:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1lND6o-0001ve-F8 for bug-guix@gnu.org; Fri, 19 Mar 2021 07:16:02 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#47257: mariadb is vulnerable to CVE-2021-27928 (RCE) Resent-From: Julien Lepiller Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Fri, 19 Mar 2021 11:16:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 47257 X-GNU-PR-Package: guix X-GNU-PR-Keywords: security To: lle-bout@zaclys.net, 47257@debbugs.gnu.org X-Debbugs-Original-To: =?UTF-8?Q?L=C3=A9o?= Le Bouter , =?UTF-8?Q?L=C3=A9o?= Le Bouter via Bug reports for GNU Guix , 47257@debbugs.gnu.org Received: via spool by submit@debbugs.gnu.org id=B.16161525517393 (code B ref -1); Fri, 19 Mar 2021 11:16:02 +0000 Received: (at submit) by debbugs.gnu.org; 19 Mar 2021 11:15:51 +0000 Received: from localhost ([127.0.0.1]:48929 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lND6c-0001vA-NU for submit@debbugs.gnu.org; Fri, 19 Mar 2021 07:15:51 -0400 Received: from lists.gnu.org ([209.51.188.17]:40364) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lND6b-0001v3-5u for submit@debbugs.gnu.org; Fri, 19 Mar 2021 07:15:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33026) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lND6a-0005d3-W1 for bug-guix@gnu.org; Fri, 19 Mar 2021 07:15:49 -0400 Received: from lepiller.eu ([2a00:5884:8208::1]:34516) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lND6U-0003d3-IW for bug-guix@gnu.org; Fri, 19 Mar 2021 07:15:48 -0400 Received: from lepiller.eu (localhost [127.0.0.1]) by lepiller.eu (OpenSMTPD) with ESMTP id c171f411; Fri, 19 Mar 2021 11:15:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=lepiller.eu; h=date :in-reply-to:references:mime-version:content-type :content-transfer-encoding:subject:to:from:message-id; s=dkim; bh=UEkuNXvWY+NBDKGWwtvOVBR9H4b/uNeOMOM2tEH/BMI=; b=jNSjfo+ddq8R VHA60W9eFVMvqxzYklbXNP2WeA85ZtLR3dc45MKLBPdWzUgIjPlhIfIEllB5yfKA dVIm4Zc2tNLXZwlvqNi9fSITz3JBBI82qU/dVXilA+M7WYiwGjZQ5t7tz7zm6f7a fb2mMwvjHt/C79IWqLHuAsbH3rmPRTO3+CtUuoBGuG2JOvjqpaTBFvYX3aOODE4h Jihuot+DRxWAwzJFNDB+Btm61fdn+xs74wWtAv5DRFdfVzE7TzYpEe5rwxQZr7/6 Hwag0ucxJzXFhM8toKtqM1AaKul8got6Vv6sf3Yaxo0l2vhTX0pcAlL4vAaMmfl9 3rr0KQ5Oiw== Received: by lepiller.eu (OpenSMTPD) with ESMTPSA id 730a576c (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Fri, 19 Mar 2021 11:15:40 +0000 (UTC) Date: Fri, 19 Mar 2021 07:15:33 -0400 User-Agent: K-9 Mail for Android In-Reply-To: <7d6d60c61fc372f62125ef5a36bc22956db5907e.camel@zaclys.net> References: <7d6d60c61fc372f62125ef5a36bc22956db5907e.camel@zaclys.net> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----0KPKK8BP7CZ2R9OXF7YPO8PA9298CQ" Content-Transfer-Encoding: 7bit From: Julien Lepiller Message-ID: <65A2F9EE-030F-4174-95B0-4A862188EA3D@lepiller.eu> Received-SPF: pass client-ip=2a00:5884:8208::1; envelope-from=julien@lepiller.eu; helo=lepiller.eu X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1616152581; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:resent-cc: resent-from:resent-sender:resent-message-id:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=ZCJzVc6TGibz0VSLFT8Y90TrLHfFmNNNV3ile0gRgP4=; b=C5rm9NHgW6zQN6u7erS7D4fXnRrvCO4MpIF2SmzSVSR9UC9IK53KTVFRLlj8Rx3EU3Bf4v 4DE7JQ0qPTMB4HbaYy5BHtCRm4BCebPuhXrZGUJdy8bMAKqaFLcgWDlGxdVbaZX00TmEPB K5oc6tOFqQgjTSKzMA9Ja+ZCSKYWm6iAWqQtyQgjc7cCJjeLg7XnAWa9ibLmplG+ykpMEg YbIfXRH3OWubUIXGr8VNx/easJRr8bW4Sszrx/zqYxLaQWODiFG69J6iIqffjtqpMtJdqX M7+MDYhHOu2f1Dc2McVyf8rZQQ3rrCkfVNTGrzLs0xpXtb8zSmCm3YEqPdyDpw== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1616152581; a=rsa-sha256; cv=none; b=E3KmWnIMivDle7zFsORpnYIOdSTbyfsFAn6hACRto5ubSzsK/bFmqzc/FrE1CMf2XX+YHJ N4taZeM7X7LE654t6HyPFZO22DXGe2+XibwO1S2DfXzUysMYQNZkdC3zYg4BjWC258fJ4Q QtQPBt6iVqmoE+V+5fc5RvvB6ehOWJRQehBtDqvbcPf0t3CyMfYDYvtx14gbqz1hnY4rxe uU6OY2sCe5QFfPcWrfNKg2rj/2EWD1xvfN4CAWcEgtyYh+Ag/MV3XUKwHcgbvITAIC6UqJ Bq4td6StywSRQSH234TCFlCCY04Op8IUjkJBwiDWbDouLSQKalD6DSoNqS6MwQ== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=lepiller.eu header.s=dkim header.b=jNSjfo+d; dmarc=fail reason="SPF not aligned (relaxed)" header.from=lepiller.eu (policy=none); spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Migadu-Spam-Score: -1.31 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=lepiller.eu header.s=dkim header.b=jNSjfo+d; dmarc=fail reason="SPF not aligned (relaxed)" header.from=lepiller.eu (policy=none); spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Migadu-Queue-Id: 28929114CF X-Spam-Score: -1.31 X-Migadu-Scanner: scn0.migadu.com X-TUID: +h/+fGPOYzuG ------0KPKK8BP7CZ2R9OXF7YPO8PA9298CQ Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable You need to graft: when building a package, the output hash depends on the = inputs, sources and instructions, so even if the content of the lib output = does not change, its store path does, leading to a rebuild=2E Le 19 mars 2021 06:25:31 GMT-04:00, "L=C3=A9o Le Bouter via Bug reports fo= r GNU Guix" a =C3=A9crit : >CVE-2021-27928 04:15 >A remote code execution issue was discovered in MariaDB 10=2E2 before >10=2E2=2E37, 10=2E3 before 10=2E3=2E28, 10=2E4 before 10=2E4=2E18, and 10= =2E5 before >10=2E5=2E9; Percona Server through 2021-03-03; and the wsrep patch throug= h >2021-03-03 for MySQL=2E An untrusted search path leads to eval injection, >in which a database SUPER user can execute OS commands after modifying >wsrep_provider and wsrep_notify_cmd=2E NOTE: this does not affect an >Oracle product=2E > >>From https://jira=2Emariadb=2Eorg/browse/MDEV-25179 it looks like 10=2E5= =2E9 >fixes it for us since we package 10=2E5=2E8 currently=2E > >However: > >$ =2E/pre-inst-env guix refresh -l mariadb >Building the following 552 packages would ensure 1047 dependent >packages are rebuilt: >[=2E=2E] > >Is it possible to graft mariadb you think? I am thinking this issue >doesnt need updating of the "lib" output which is what's causing the >high number of dependents AIUI=2E I am not sure we could actually update >individual outputs right now though=2E Might be a good idea to split the >packages for the future=2E > >L=C3=A9o ------0KPKK8BP7CZ2R9OXF7YPO8PA9298CQ Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable You need to graft: when building a package, the ou= tput hash depends on the inputs, sources and instructions, so even if the c= ontent of the lib output does not change, its store path does, leading to a= rebuild=2E

Le 19 mars 2021 06:25:31 GMT-= 04:00, "L=C3=A9o Le Bouter via Bug reports for GNU Guix" <bug-guix@gnu= =2Eorg> a =C3=A9crit :
CVE-2021-27928	04:15
A remote code execution issu=
e was discovered in MariaDB 10=2E2 before
10=2E2=2E37, 10=2E3 before 10=
=2E3=2E28, 10=2E4 before 10=2E4=2E18, and 10=2E5 before
10=2E5=2E9; Perc=
ona Server through 2021-03-03; and the wsrep patch through
2021-03-03 fo=
r MySQL=2E An untrusted search path leads to eval injection,
in which a =
database SUPER user can execute OS commands after modifying
wsrep_provid=
er and wsrep_notify_cmd=2E NOTE: this does not affect an
Oracle product=
=2E

From =
https://jira=2Emariadb=2Eorg/browse/MDEV-25179 it looks like 10=2E5=2E9=

fixes it for us since we package 10=2E5=2E8 currently=2E

However=
:

$ =2E/pre-inst-env guix refresh -l mariadb
Building the followi=
ng 552 packages would ensure 1047 dependent
packages are rebuilt:
[=
=2E=2E]

Is it possible to graft mariadb you think? I am thinking thi=
s issue
doesnt need updating of the "lib" output which is what's causing=
 the
high number of dependents AIUI=2E I am not sure we could actually u=
pdate
individual outputs right now though=2E Might be a good idea to spl=
it the
packages for the future=2E

L=C3=A9o
=
------0KPKK8BP7CZ2R9OXF7YPO8PA9298CQ--