Debian Bug report logs - #885345
mariadb-10.1: CVE-2017-15365: Replication in sql/event_data_objects.cc occurs before ACL checks

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: mariadb-10.1: CVE-2017-15365: Replication in sql/event_data_objects.cc occurs before ACL checks

Date: Tue, 26 Dec 2017 15:15:35 +0100

Source: mariadb-10.1
Version: 1:10.1.29-6
Severity: important
Tags: security upstream fixed-upstream
Control: found -1 10.1.23-1


Hi,

the following vulnerability was published for mariadb-10.1, this is
fixed in 10.1.30.

CVE-2017-15365[0]:
Replication in sql/event_data_objects.cc occurs before ACL checks

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-15365
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15365
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1524234

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 885345@bugs.debian.org (full text, mbox, reply):

From: Otto Kekäläinen <otto@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 885345@bugs.debian.org

Subject: Re: [debian-mysql] Bug#885345: mariadb-10.1: CVE-2017-15365: Replication in sql/event_data_objects.cc occurs before ACL checks

Date: Fri, 29 Dec 2017 14:22:19 +0200

FYI, I have been working on this since yesterday, but there is a lot
of things to clean up / fix due to upstream Debian packaging changes
in a stable release, packaging changes by Ondrej in our Debian
packaging git repo so I need to adapt a new workflow for myself, and
then the fact that 10.1.29 was made and git committed for stable point
release upload, but it wasn't accepted.

(release team didn't respond to Ondrej's last message on Dec 11th at
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882909)

So things are in progress but moving slowly unfortunately..

2017-12-26 16:15 GMT+02:00 Salvatore Bonaccorso <carnil@debian.org>:
> Source: mariadb-10.1
> Version: 1:10.1.29-6
> Severity: important
> Tags: security upstream fixed-upstream
> Control: found -1 10.1.23-1
>
>
> Hi,
>
> the following vulnerability was published for mariadb-10.1, this is
> fixed in 10.1.30.
>
> CVE-2017-15365[0]:
> Replication in sql/event_data_objects.cc occurs before ACL checks
>
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2017-15365
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15365
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1524234
>
> Please adjust the affected versions in the BTS as needed.

Message #17 received at 885345@bugs.debian.org (full text, mbox, reply):

From: Otto Kekäläinen <otto@debian.org>

To: 885345@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>, Ondřej Surý <ondrej@debian.org>

Subject: Re: [debian-mysql] Bug#885345: Bug#885345: mariadb-10.1: CVE-2017-15365: Replication in sql/event_data_objects.cc occurs before ACL checks

Date: Sat, 30 Dec 2017 18:10:30 +0200

I have prepared 10.1.30 for upload to Stretch and work is pushed to
git.debian.org.
CVE entries are updated
https://anonscm.debian.org/cgit/pkg-mysql/mariadb-10.1.git/commit/?h=stretch

Currently the test builds on arm64 are failing:
https://launchpad.net/~mysql-ubuntu/+archive/ubuntu/mariadb-10.1/+builds?build_text=&build_state=all
I am looking into them..

Please advice what to do with the point release of .29 vs security
update of .30 situation.

Message #22 received at 885345@bugs.debian.org (full text, mbox, reply):

From: Otto Kekäläinen <otto@debian.org>

To: 885345@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>, Ondřej Surý <ondrej@debian.org>

Subject: Re: [debian-mysql] Bug#885345: Bug#885345: Bug#885345: mariadb-10.1: CVE-2017-15365: Replication in sql/event_data_objects.cc occurs before ACL checks

Date: Tue, 2 Jan 2018 14:00:17 +0200

2017-12-30 18:10 GMT+02:00 Otto Kekäläinen <otto@debian.org>:
> I have prepared 10.1.30 for upload to Stretch and work is pushed to
> git.debian.org.
> CVE entries are updated
> https://anonscm.debian.org/cgit/pkg-mysql/mariadb-10.1.git/commit/?h=stretch
>
> Currently the test builds on arm64 are failing:
> https://launchpad.net/~mysql-ubuntu/+archive/ubuntu/mariadb-10.1/+builds?build_text=&build_state=all
> I am looking into them..

arm64 issue is now patched and the freshly pushed stretch branch is
ready for upload as security update to stretch if that is the correct
thing to do now.

Please advice.

Send a report that this bug log contains spam.