Bug 1529540

Summary:	anki: Security issue in .apkg imports fixed in 2.0.47
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	chkr, psampaio, thomas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-05-31 23:09:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1529541
Bug Blocks:

Description Pedro Sampaio 2017-12-28 15:16:59 UTC

"I have just released 2.0.47. It fixes an issue that could allow a specially crafted .apkg file to write files outside the media folder during import. AnkiWeb shared decks were not affected, but upgrading is strongly recommended if you import .apkg files from third party sources. A big thanks to David Bailey for discovering this issue." [1]

References:

https://anki.tenderapp.com/discussions/announcements/122-security-issue-in-apkg-imports-from-third-party-sources-on-anki-2047

Comment 1 Pedro Sampaio 2017-12-28 15:17:27 UTC

Created anki tracking bugs for this issue:

Affects: fedora-all [bug 1529541]

Comment 2 Thomas Drake-Brockman 2018-04-07 10:15:01 UTC

Planning to resolve this by packaging 2.0.50 shortly.

Comment 3 Fedora Update System 2018-04-17 00:18:17 UTC

anki-2.0.50-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2018-04-25 17:58:52 UTC

anki-2.0.50-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2018-04-25 18:15:51 UTC

anki-2.0.50-1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Thomas Drake-Brockman 2018-05-31 12:27:41 UTC

I believe this can be closed now given that 2.0.50 has been packaged.

Comment 7 Pedro Sampaio 2018-05-31 19:23:14 UTC

Yes, feel free to close it. Thanks.