[ubuntu/jammy-security] multipath-tools 0.8.8-1ubuntu1.22.04.1 (Accepted)

[Marc Deslauriers]

multipath-tools (0.8.8-1ubuntu1.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: symlink attack
    - debian/patches/CVE-2022-41973.patch: use /run instead of /dev/shm in
      .gitignore, Makefile.inc, libmultipath/defaults.h,
      multipath/Makefile, multipath/multipath.rules.in,
      multipath/tmpfiles.conf.in.
    - debian/multipath-tools.install: install tmpfiles.d/multipath.conf.
    - debian/rules: copy udev rule after build.
    - CVE-2022-41973
  * SECURITY UPDATE: authorization bypass
    - debian/patches/CVE-2022-41974-pre1.patch: fix command completion in
      interactive mode in multipathd/callbacks.c, multipathd/cli.c,
      multipathd/cli_handlers.c, multipathd/main.c.
    - debian/patches/CVE-2022-41974.patch: more robust command parsing in
      multipathd/callbacks.c, multipathd/cli.c, multipathd/cli.h,
      multipathd/cli_handlers.c, multipathd/uxlsnr.c.
    - debian/patches/CVE-2022-41974-2.patch: fix command completion with
      robust parser in multipathd/cli.c, multipathd/cli.h,
      multipathd/uxlsnr.c.
    - debian/patches/CVE-2022-41974-3.patch: add test for command parsing
      in Makefile.inc, tests/Makefile, tests/cli.c, multipathd/cli.h,
      multipathd/cli.c.
    - debian/patches/CVE-2022-41974-4.patch: fix memory leak handling
      invalid commands in multipathd/uxlsnr.c.
    - CVE-2022-41974

Date: 2022-10-31 20:47:16.482568+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/multipath-tools/0.8.8-1ubuntu1.22.04.1
-------------- next part --------------
Sorry, changesfile not available.