[Bug 42317] New: [CVE-2014-1626] Require MARC::File::XML > 1.0.2
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Bug ID: 42317 Summary: [CVE-2014-1626] Require MARC::File::XML > 1.0.2 Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org CVE-2014-1626 notes vulnerabilities in MARC::File::XML in versions less than 1.0.2. Looking at Koha's cpanfile we say that we require at least version 1.0.1, but that should be updated to 1.0.2 or even 1.0.5 since in practice only 1.0.5 is really available via CPAN or Debian repos. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Created attachment 196985 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196985&action=edit Bug 42317: Update minimum version for MARC::File::XML This patch updates cpanfile to reflect the real minimum version needed for MARC::File::XML. This is particularly important due to vulnerabilities in version 1.0.1 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #196985|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 197019 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197019&action=edit Bug 42317: Update minimum version for MARC::File::XML This patch updates cpanfile to reflect the real minimum version needed for MARC::File::XML. This is particularly important due to vulnerabilities in version 1.0.1 Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This updates the CPAN file release notes| |to reflect the minimum | |version | |needed for the | |MARC::File::XML Perl | |module. This is important | |because of the | |vulnerabilities in version | |1.0.1. | | | |(Note: This should not | |cause any issues, as v1.0.5 | |is available and already | |used from Debian | |repositories for | |installation.) --- Comment #3 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. In the staff interface go to More > About Koha > Perl modules 2. Search for MARC::File::XML 3. Note the versions: - Current version: v1.0.5 - Minimum version: v1.0.1 4. Apply the patch. 5. Restart everything: restart_all 6. Hard refresh the Perl modules page (Shift + Refresh button?) 7. Repeat step 2. 8. Note that the minium version is updated: - Current version: v1.0.5 - Minimum version: v1.0.5 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- Many thanks, David! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Signed Off |Passed QA QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #197019|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #5 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 197578 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197578&action=edit Bug 42317: Update minimum version for MARC::File::XML This patch updates cpanfile to reflect the real minimum version needed for MARC::File::XML. This is particularly important due to vulnerabilities in version 1.0.1 Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #6 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to David Cook from comment #0)
CVE-2014-1626 notes vulnerabilities in MARC::File::XML in versions less than 1.0.2.
Looking at Koha's cpanfile we say that we require at least version 1.0.1, but that should be updated to 1.0.2 or even 1.0.5 since in practice only 1.0.5 is really available via CPAN or Debian repos.
Confirmed bullseye libmarc-xml-perl (1.0.5-1) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #197578|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #7 from Mason James <mtj@kohaaloha.com> --- Created attachment 198910 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198910&action=edit Bug 42317: Update minimum version for MARC::File::XML This patch updates cpanfile to reflect the real minimum version needed for MARC::File::XML. This is particularly important due to vulnerabilities in version 1.0.1 Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: mason james <mtj@kohaaloha.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com --- Comment #8 from Mason James <mtj@kohaaloha.com> --- (In reply to Marcel de Rooy from comment #6)
(In reply to David Cook from comment #0)
CVE-2014-1626 notes vulnerabilities in MARC::File::XML in versions less than 1.0.2.
Looking at Koha's cpanfile we say that we require at least version 1.0.1, but that should be updated to 1.0.2 or even 1.0.5 since in practice only 1.0.5 is really available via CPAN or Debian repos.
Confirmed bullseye libmarc-xml-perl (1.0.5-1)
thanks Marcel libmarc-xml-perl (1.0.5) is available in all supported debian version https://tracker.debian.org/pkg/libmarc-xml-perl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #9 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|26.05.00 |26.05.00,25.11.05 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 --- Comment #10 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Thanks all, pushed to 25.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_24_11_candidate, | |rel_25_05_candidate CC| |fridolin.somers@biblibre.co | |m, | |wainuiwitikapark@catalyst.n | |et.nz --- Comment #11 from David Cook <dcook@prosentient.com.au> --- Looks like this one is still needed for 25.05 and 24.11. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00,25.11.05 |26.05.00,25.11.05,25.05.13 released in| | Status|Pushed to stable |Pushed to oldstable --- Comment #12 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Applying to 25.05.x for 25.05.13 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Pushed to oldoldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldstable |Pushed to oldoldoldstable Version(s)|26.05.00,25.11.05,25.05.13 |26.05.00,25.11.05,25.05.13, released in| |24.11.18 --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.18 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |Needs documenting -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42317 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #14 from David Nind <david@davidnind.com> --- Architecture change - minimum version of a CPAN module updated. No changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org