Bug 1210748 (CVE-2015-0840)

Summary:	CVE-2015-0840 dpkg: source package integrity verification bypass
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	andrew, carnil, jrusnack, sergio, vanmeeuwen+fedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dpkg 1.16.16, dpkg 1.17.25	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-05-14 11:28:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1210749, 1210750
Bug Blocks:

Description Vasyl Kaigorodov 2015-04-10 13:33:31 UTC

Jann Horn discovered that the source package integrity verification in
dpkg-source can be bypassed via a specially crafted Debian source
control file (.dsc). Note that this flaw only affects extraction of
local Debian source packages via dpkg-source but not the installation of
packages from the Debian archive.

For the stable distribution (wheezy), this problem has been fixed in
version 1.16.16. This update also includes non-security changes
previously scheduled for the next wheezy point release. See the Debian
changelog for details.

For the unstable distribution (sid), this problem has been fixed in
version 1.17.25.

Comment 1 Vasyl Kaigorodov 2015-04-10 13:34:29 UTC

Created dpkg tracking bugs for this issue:

Affects: fedora-all [bug 1210749]
Affects: epel-all [bug 1210750]

Comment 2 Fedora Update System 2015-05-08 07:45:04 UTC

dpkg-1.16.16-5.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2015-05-12 20:48:19 UTC

dpkg-1.16.16-5.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2015-05-12 20:49:26 UTC

dpkg-1.16.16-5.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-05-14 06:29:29 UTC

dpkg-1.16.16-5.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-05-14 06:30:12 UTC

dpkg-1.16.16-5.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Sergio Basto 2015-05-14 11:28:51 UTC

I couldn't build dpkg for el5 because 

DEBUG util.py:388:  Error: No Package found for po4a [1]


https://kojipkgs.fedoraproject.org//work/tasks/5213/9525213/root.log