Bug 1202088 (CVE-2022-30187) - VUL-0: CVE-2022-30187: python-azure-storage-blob: Information Disclosure Vulnerability
Summary: VUL-0: CVE-2022-30187: python-azure-storage-blob: Information Disclosure Vuln...
Status: RESOLVED FIXED
Alias: CVE-2022-30187
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: John Paul Adrian Glaubitz
QA Contact: SUSE Public Cloud Maintainer
URL: https://smash.suse.de/issue/337116/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-08-03 07:51 UTC by Robert Frohl
Modified: 2025-05-04 09:31 UTC (History)
11 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Robert Frohl 2022-08-03 07:53:11 UTC
tracking as affected

- SUSE:SLE-12-SP1:Update/python-azure-storage-blob
- SUSE:SLE-15:Update/python-azure-storage-blob
- SUSE:SLE-15-SP1:Update/python-azure-storage-blob
Comment 3 John Paul Adrian Glaubitz 2022-08-03 08:03:33 UTC
Would be nice if we could figure out which commit fixed the issue as updating individual SDK components can always have side effects.
Comment 4 Robert Schweikert 2022-08-04 20:49:44 UTC
Also requires storage-queue 12.4
Comment 12 Robert Schweikert 2022-08-18 13:14:21 UTC
But this is not possible for SLE 12, we cannot do a wholesale update in SLE 12 because Python 2.7 support has been dropped upstream.

A wholesale update would only be possible in SLE 12 if we drop the Python 2.7 builds, but since the packages cannot be removed we'd still be shipping packages with a known vulnerability that cannot be updated. We have to find a path that allows us to address the issue in the Python 2.7 build.
Comment 13 John Paul Adrian Glaubitz 2022-08-25 13:15:13 UTC
(In reply to Robert Schweikert from comment #12)
> But this is not possible for SLE 12, we cannot do a wholesale update in SLE
> 12 because Python 2.7 support has been dropped upstream.
> 
> A wholesale update would only be possible in SLE 12 if we drop the Python
> 2.7 builds, but since the packages cannot be removed we'd still be shipping
> packages with a known vulnerability that cannot be updated. We have to find
> a path that allows us to address the issue in the Python 2.7 build.

I agree. However, I'm not sure how to backport the change which is rather big and requires a newer version of python-azure-core.
Comment 14 Robert Frohl 2022-09-19 13:56:02 UTC
so what about SLE15 and SLE15-SP1? Would fixing it there be possible ?
Comment 15 Marcus Meissner 2022-09-19 13:57:10 UTC
Is this new encryption support going to be required to be provided for SLE12?
Comment 16 Lidong Zhong 2022-09-23 01:51:13 UTC
(In reply to Robert Frohl from comment #14)
> so what about SLE15 and SLE15-SP1? Would fixing it there be possible ?

Any update about this question please? We have one related L3 incident.
Comment 17 John Paul Adrian Glaubitz 2022-09-23 07:38:22 UTC
(In reply to Lidong Zhong from comment #16)
> (In reply to Robert Frohl from comment #14)
> > so what about SLE15 and SLE15-SP1? Would fixing it there be possible ?
> 
> Any update about this question please? We have one related L3 incident.

Fixing this involves updating the python-azure-storage-blob version to the latest version. This is unfortunately not trivial as the update introduces a dependency on the python-typing_extensions package which requires a plethora if other package updates.

I was hoping for a backport of the fix from Microsoft but since this did not happen, I will try to patch the python-typing_extensions dependency out to avoid pulling in so many additional package updates.
Comment 24 Jake Norris 2022-10-31 14:46:42 UTC
As mentioned in comment 23, I have a customer associated with bug 1203582 that is asking for a fix or some sort of guidance on what they should be doing to address this issue.
Comment 25 John Paul Adrian Glaubitz 2022-10-31 14:56:04 UTC
(In reply to Jake Norris from comment #24)
> As mentioned in comment 23, I have a customer associated with bug 1203582
> that is asking for a fix or some sort of guidance on what they should be
> doing to address this issue.

I can prepare a repository with a preliminary set of updated packages tomorrow which fixes this issue if that would be OK?
Comment 26 Lidong Zhong 2022-11-01 07:57:25 UTC
(In reply to John Paul Adrian Glaubitz from comment #25)
> I can prepare a repository with a preliminary set of updated packages
> tomorrow which fixes this issue if that would be OK?

It's better to let me prepare the packages based on your patches. So we can track the PTFs we delivered to each customer.
Comment 27 John Paul Adrian Glaubitz 2022-11-01 08:48:52 UTC
(In reply to Lidong Zhong from comment #26)
> (In reply to John Paul Adrian Glaubitz from comment #25)
> > I can prepare a repository with a preliminary set of updated packages
> > tomorrow which fixes this issue if that would be OK?
> 
> It's better to let me prepare the packages based on your patches. So we can
> track the PTFs we delivered to each customer.

The problem is that the CVE is not fixed by a few patches as the number of changes are too big.

The fix involves updating at least two packages: python-azure-storage-blob and python-azure-core.
Comment 28 Lidong Zhong 2022-11-02 04:08:38 UTC
(In reply to John Paul Adrian Glaubitz from comment #27)
> The problem is that the CVE is not fixed by a few patches as the number of
> changes are too big.
> 
> The fix involves updating at least two packages: python-azure-storage-blob
> and python-azure-core.

OK. Then I think I can prepare the PTF based on your IBS project. Please let me know what's your IBS project when it's done.
Comment 29 John Paul Adrian Glaubitz 2022-11-02 07:32:26 UTC
(In reply to Lidong Zhong from comment #28)
> (In reply to John Paul Adrian Glaubitz from comment #27)
> > The problem is that the CVE is not fixed by a few patches as the number of
> > changes are too big.
> > 
> > The fix involves updating at least two packages: python-azure-storage-blob
> > and python-azure-core.
> 
> OK. Then I think I can prepare the PTF based on your IBS project. Please let
> me know what's your IBS project when it's done.

Here you go:

> https://build.suse.de/project/show/home:glaubitz:staging41:SUSE-SLE-15-SP1:Update

Basically, this updates python-azure-storage-blob to 12.13.1 (the CVE fix is part of 12.13.0).

Updating python-azure-storage-blob to 12.13.x requires python-azure-core to be updated to 1.23.1 hence this package is included in the update.

Both packages were cherry-picked from openSUSE Factory, however python-azure-core was modified to allow an older version of python-typing_extensions (3.10.0.0 instead of 4.0.1).

The compatibility with the older version of python-typing_extensions was verified according a small type check test provided by upstream [1].

> [1] https://github.com/Azure/azure-sdk-for-python/pull/22891#issuecomment-1283068774
Comment 30 Lidong Zhong 2022-11-03 02:35:53 UTC
Thanks for the work. PTF based on this project has been provided to customer.
Comment 38 Maintenance Automation 2023-11-29 12:30:01 UTC
SUSE-SU-2023:4609-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1202088
CVE References: CVE-2022-30187
Sources used:
Public Cloud Module 15-SP2 (src): python-azure-storage-queue-12.4.0-150100.3.7.1
Public Cloud Module 15-SP1 (src): python-azure-storage-queue-12.4.0-150100.3.7.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 46 Maintenance Automation 2024-02-27 11:34:38 UTC
SUSE-SU-2023:2897-1: An update that solves one vulnerability, contains two features and has one security fix can now be installed.

Category: security (critical)
Bug References: 1199282, 1202088
CVE References: CVE-2022-30187
Jira References: PM-3243, SLE-24629
Sources used:
openSUSE Leap 15.4 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1
openSUSE Leap 15.5 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1
Public Cloud Module 15-SP1 (src): python-azure-core-1.23.1-150100.3.13.1, python-typing_extensions-3.10.0.0-150100.3.5.1, python-azure-storage-blob-12.13.1-150100.3.10.1
Public Cloud Module 15-SP2 (src): python-azure-core-1.23.1-150100.3.13.1, python-typing_extensions-3.10.0.0-150100.3.5.1, python-azure-storage-blob-12.13.1-150100.3.10.1
Public Cloud Module 15-SP3 (src): python-azure-core-1.23.1-150100.3.13.1, python-typing_extensions-3.10.0.0-150100.3.5.1, python-azure-storage-blob-12.13.1-150100.3.10.1
Public Cloud Module 15-SP4 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1
Public Cloud Module 15-SP5 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 50 Maintenance Automation 2024-08-19 12:40:51 UTC
SUSE-SU-2024:1670-1: An update that solves one vulnerability can now be installed.

URL: https://www.suse.com/support/update/announcement/2024/suse-su-20241670-1
Category: security (moderate)
Bug References: 1202088
CVE References: CVE-2022-30187
Maintenance Incident: [SUSE:Maintenance:32136](https://smelt.suse.de/incident/32136/)
Sources used:
Public Cloud Module 12 (src):
 python-azure-storage-blob-12.13.1-2.10.8, python-typing_extensions-3.10.0.0-2.6.1, python-azure-storage-queue-12.4.0-2.10.8, python-azure-core-1.23.1-2.12.8

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.