Bug 2004423

Summary:	CVE-2021-3802 udisks2: insecure defaults in user-accessible mount helpers allow for a DoS [rhel-9.0]
Product:	Red Hat Enterprise Linux 9	Reporter:	Sandipan Roy <saroy>
Component:	udisks2	Assignee:	Tomáš Bžatek <tbzatek>
Status:	CLOSED ERRATA	QA Contact:	guazhang <guazhang>
Severity:	low	Docs Contact:
Priority:	low
Version:	9.0	CC:	guazhang, mrehak
Target Milestone:	rc	Keywords:	Security, SecurityTracking, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	udisks2-2.9.4-1.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 12:52:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2010363
Bug Blocks:	2003649

Description Sandipan Roy 2021-09-15 09:18:12 UTC

rhel-9 tracking bug for udisks2: see the bugs linked in the "Blocks" field of this bug for full details of the security issue(s).

This bug is never intended to be made public, please put any public notes in the blocked bugs.

For the Enterprise Linux security issues handling process overview see:
https://source.redhat.com/groups/public/product-security/content/product_security_wiki/eus_z_stream_and_security_bugs

Comment 1 Tomáš Bžatek 2021-10-04 14:00:00 UTC

Requested rebase to the upstream 2.9.4 release that includes the fix: bug 2010363

Comment 5 guazhang@redhat.com 2021-11-03 07:14:54 UTC

Test pass with fixed package, move to verified.

Comment 7 errata-xmlrpc 2022-05-17 12:52:43 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: udisks2), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2413