Groups > linux.debian.bugs.dist > #1148916

Bug#1037175: [preapproval] bullseye-pu: package org-mode/9.4.0+dfsg-1+deb11u1

Path	csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Nicholas D Steeves <sten@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.devel.release
Subject	Bug#1037175: [preapproval] bullseye-pu: package org-mode/9.4.0+dfsg-1+deb11u1
Date	Wed, 07 Jun 2023 05:10:01 +0200
Message-ID	<GDRIB-ebZN-1@gated-at.bofh.it> (permalink)
X-Original-To	Debian Bug Tracking System <submit@bugs.debian.org>
X-Mailbox-Line	From debian-bugs-dist-request@lists.debian.org Wed Jun 7 03:03:12 2023
Old-Return-Path	<debbugs@buxtehude.debian.org>
X-Spam-Flag	NO
X-Spam-Score	-4.21
Reply-To	Nicholas D Steeves <sten@debian.org>, 1037175@bugs.debian.org
Resent-To	debian-bugs-dist@lists.debian.org
Resent-Cc	sten@debian.org, Debian Release Team <debian-release@lists.debian.org>
X-Debian-Pr-Message	report 1037175
X-Debian-Pr-Package	release.debian.org
X-Debian-Pr-Keywords	bullseye
Content-Type	multipart/mixed; boundary="===============2845712970868382978=="
MIME-Version	1.0
X-Mailer	reportbug 7.10.3+deb11u1
X-Debian-Message	from BTS
X-Mailing-List	<debian-bugs-dist@lists.debian.org> archive/latest/1773995
List-ID	<debian-bugs-dist.lists.debian.org>
List-URL	<https://lists.debian.org/debian-bugs-dist/>
Approved	robomod@news.nic.it
Lines	132
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Tue, 06 Jun 2023 23:00:14 -0400
X-Original-Message-ID	<168610681415.387899.13575458549094574142.reportbug@bras-base-mtrlpq0313w-grc-04-65-94-64-248.dsl.bell.ca>
Xref	csiph.com linux.debian.bugs.dist:1148916 linux.debian.devel.release:116784

Cross-posted to 2 groups.

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
Tags: bullseye
User: release.debian.org@packages.debian.org
Usertags: pu

Dear Release Team,

[ Reason ]
https://security-tracker.debian.org/tracker/CVE-2023-28617
Bug #1033341

latex in ob-latex.el in Org Mode (≤9.6.1) allows attackers to execute
arbitrary commands via a file name or directory name that contains
shell metacharacters.

At this time, org-mode 9.1.14+dfsg-3 in buster continues to be
affected.  Bullseye's copy of Emacs also has a bundled version that is
effected, and I'm willing to patch that copy too.  Elpa-org-mode is a
modular add-on that upgrades and shadows that copy, by the way, so
the CVE should be fixed here first.

[ Impact ]
Security risk that is worth the effort to fix.  Emacs has no
sandboxing...  Carnil asked me to "consider proposing a fix via the
upcoming bullseye point release" (#1033341), so here I am!

[ Tests ]
For the version of src:org-mode, in bullseye, manual testing; however,
the same fix has been tested in the bundled copy of Org-mode that
is part of Emacs in bookworm.  This fix has seen two months of testing.

[ Risks ]
It's a trivial and fairly obvious fix that was discussed upstream here:
https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A@qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e?cve=title

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
A cherry picked patch that has been tested in bookworm for two months,
an update to the series file, and a changelog entry.  The patch
replaces calls to the external "mv" command with Emacs internal
function "rename-file", which has been in active use since the '80s.


Thank you for all the work that you are doing for bookworm!
Regards,
Nicholas

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1037175: [preapproval] bullseye-pu: package org-mode/9.4.0+dfsg-1+deb11u1 Nicholas D Steeves <sten@debian.org> - 2023-06-07 05:10 +0200
  Bug#1037175: [preapproval] bullseye-pu: package org-mode/9.4.0+dfsg-1+deb11u1 Salvatore Bonaccorso <carnil@debian.org> - 2023-06-07 21:20 +0200
  Bug#1037175: [preapproval] bullseye-pu: package org-mode/9.4.0+dfsg-1+deb11u1 Salvatore Bonaccorso <carnil@debian.org> - 2023-06-13 07:10 +0200

csiph-web