Bug 1965405

Summary:	CVE-2020-18032 buffer overflow in lib/common/shapes.c
Product:	Red Hat Enterprise Linux 8	Reporter:	Michel Lind <michel>
Component:	graphviz	Assignee:	Jaroslav Škarvada <jskarvad>
Status:	CLOSED WONTFIX	QA Contact:	rhel-cs-infra-services-qe <rhel-cs-infra-services-qe>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	CentOS Stream	CC:	bstinson, carl, davide, jwboyer, kayvansylvan, security-response-team
Target Milestone:	beta	Flags:	pm-rhel: mirror+
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-11-27 07:27:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1963395
Bug Blocks:	1966272

Description Michel Lind 2021-05-27 16:23:04 UTC

Description of problem:
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.

Version-Release number of selected component (if applicable):
graphviz-2.40.1-40.el8

Fixed in Fedora (see linked bug)

Upstream commit fixing this: https://gitlab.com/graphviz/graphviz/-/commit/784411ca3655c80da0f6025ab20634b2a6ff696b)

Confirmed not in the c8s branch:
../centos-git-common/get_sources.sh ./SPECS/graphviz.spec
rpmbuild -D "_topdir $(pwd)" -bp ./SPECS/graphviz.spec
inspect lib/common/shapes.c

Additional info:
Other trackers
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-18032
Debian https://security-tracker.debian.org/tracker/CVE-2020-18032
SUSE https://www.suse.com/security/cve/CVE-2020-18032/ (site seems down)
Ubuntu (rating this a 9.8) https://ubuntu.com/security/CVE-2020-18032

Comment 1 Michel Lind 2021-05-27 16:39:23 UTC

PS the Source0 URL no longer works, I pulled the source from the lookaside cache to check this. Might be worth fixing at the same time

Comment 3 RHEL Program Management 2022-11-27 07:27:41 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.