Bug 1962307 (CVE-2021-3200)

Summary: CVE-2021-3200 libsolv: heap-based buffer overflow in testcase_read() in src/testcase.c
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bbuckingham, bcoca, bcourt, bkearney, btotty, chousekn, cmeyers, davidn, gblomqui, hhudgeon, igor.raits, jcammara, jhardy, jmracek, jobarker, jrohel, kaycoth, lzap, mabashia, mcermak, mmccune, ngompa13, nmoumoul, osapryki, packaging-team-maint, pcreech, pkratoch, rchan, relrod, rjerrido, rpetrell, rpm-software-management, sdoran, smcdonal, sokeeffe, tkuratom, vmugicag, ytale
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: libsolv 0.7.17 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-11-02 23:32:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1973712, 1962308, 1966716, 1968516    
Bug Blocks: 1962309    

Description Guilherme de Almeida Suckevicz 2021-05-19 17:41:36 UTC
Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334, which could cause a denial of service


Comment 1 Guilherme de Almeida Suckevicz 2021-05-19 17:42:22 UTC
Created libsolv tracking bugs for this issue:

Affects: fedora-all [bug 1962308]

Comment 6 Tapas Jena 2021-06-18 14:22:26 UTC
Analysis is complete for Ansible Automation Platform and it was found that the vulnerable library is being used by Pulp Core component of AAP 1.2 as shown below:

However, this is an indirect dependency which gets pulled up in all the stacks while installing Automation Hub. That means, Pulp core is just relying on a package which rely on libsolv Lib. Hence, the ansible component i.e. pulp core is not directly impacted by this vulnerability. Moreover, as the vulnerable function i.e. testcase_read() is being used in in Test systems only, not anywhere in Production environment. Hence, changing the severity to "Low" for Ansible.

Comment 10 errata-xmlrpc 2021-11-09 18:40:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4408 https://access.redhat.com/errata/RHSA-2021:4408

Comment 11 errata-xmlrpc 2022-07-05 14:26:31 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.11 for RHEL 7
  Red Hat Satellite 6.11 for RHEL 8

Via RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498