|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2023-49346: budgie-extras: budgie-weathershow: use of fixed path in /tmp/<username>_weatherdata | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Matthias Gerstner <matthias.gerstner> |
| Component: | Audits | Assignee: | Security Team bot <security-team> |
| Status: | IN_PROGRESS --- | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | matthias.gerstner, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Bug Depends on: | |||
| Bug Blocks: | 1216279 | ||
| Attachments: | upstream patch | ||
|
Description
Matthias Gerstner
2023-10-16 12:53:39 UTC
Please treat this information privately until we hear back from upstream. This means also not submitting anything about this in OBS for the time being. This is an embargoed bug. This means that this information is not public. Please do NOT: - talk to other people about this unless they're involved in fixing the issue - make this bug public - submit this into OBS (e.g. fix Leap/Tumbleweed) until this bug becomes public. This means that the security team removed the EMBARGOED tag from the bug title after we verified that there's already information about this bug publicly available. If you find such information yourself and the bug is still embargoed please contact us Your primary responsibility is to apply a fix for this issue. Here is some guidance on openSUSE package maintenance: - https://en.opensuse.org/openSUSE:Package_maintenance - https://en.opensuse.org/openSUSE:Maintenance_update_process You need to submit AFTER the bug became public, to the current openSUSE Leap codestreams, and to the devel project of your package. The security team will then take the following steps: - We wait for your submission and package them into an incident for QA testing. The QA tester might reach out to you if they find issues with the update. - If QA doesn't find any issues, we publish the updates. You can contact us at: * IRC: irc.suse.de #security * Do NOT use Slack or any non-SUSE hosted messaging services * Email: security-team@suse.de Upstream agrees to follow coordinates disclosure and they aim to release an update by the end of the year. I will update once there is a more concrete date or patches available. We got this CVE communicated by upstream, the fix will be in release 1.7.1, but I don't have a publication date yet. Created attachment 871132 [details]
upstream patch
Upstream plans to publish the release 1.7.1 on the date mentioned in comment 6. Their suggested patch is found in comment 7. Please *don't* publish anything in the build service before we give green light. You can privately prepare an update using the given patch but it will likely be simpler to simply use the upstream release once it is public. This is now public via the 1.7.1 upstream release: https://github.com/UbuntuBudgie/budgie-extras/releases/tag/v1.7.1. Please package the new version and submit to all maintained OBS codestreams. This is an autogenerated message for OBS integration: This bug (1216282) was mentioned in https://build.opensuse.org/request/show/1133097 Factory / budgie-extras complete |