Bug 1665538 (CVE-2018-20534)

Summary: CVE-2018-20534 libsolv: illegal address access in pool_whatprovides in src/pool.h
Product: [Other] Security Response Reporter: Laura Pardo <lpardo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jrohel
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-06 19:20:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1665539, 1670453, 1670454    
Bug Blocks: 1665540    

Description Laura Pardo 2019-01-11 16:59:13 UTC
A vulnerability was found in libsolv through 0.7.2. There is an illegal address access at src/pool.h (function pool_whatprovides) in libsolv.a that will cause a denial of service.


Upstream Patch:

Comment 1 Laura Pardo 2019-01-11 16:59:42 UTC
Created libsolv tracking bugs for this issue:

Affects: fedora-all [bug 1665539]

Comment 2 Riccardo Schirone 2019-01-29 14:56:52 UTC
When function testcase_str2solvid() is called on a malformed input, pool may be not correctly initialized and pool->whatprovides may be NULL, causing the program to crash when accessing an illegal address in pool_whatprovides().

Comment 5 errata-xmlrpc 2019-08-06 12:37:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2290 https://access.redhat.com/errata/RHSA-2019:2290

Comment 6 Product Security DevOps Team 2019-08-06 19:20:39 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 7 errata-xmlrpc 2019-11-05 21:15:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3583 https://access.redhat.com/errata/RHSA-2019:3583