Bug 2185019 (CVE-2023-29415, CVE-2023-29416, CVE-2023-29417, CVE-2023-29418, CVE-2023-29419, CVE-2023-29420, CVE-2023-29421)

Summary:	CVE-2023-29415 CVE-2023-29416 CVE-2023-29417 CVE-2023-29418 CVE-2023-29419 CVE-2023-29420 CVE-2023-29421 bzip3: Multiple vulnerabilities
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-04-06 19:07:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2185020, 2185021
Bug Blocks:

Description Pedro Sampaio 2023-04-06 14:16:17 UTC

CVE-2023-29415
An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.

https://github.com/kspalaiologos/bzip3/issues/95
https://github.com/kspalaiologos/bzip3/compare/1.2.3...1.3.0

CVE-2023-29416
An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.

https://github.com/kspalaiologos/bzip3/issues/92
https://github.com/kspalaiologos/bzip3/compare/1.2.3...1.3.0
https://github.com/kspalaiologos/bzip3/commit/bfa5bf82b53715dfedf048e5859a46cf248668ff

CVE-2023-29417
** DISPUTED ** An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.

https://github.com/kspalaiologos/bzip3/issues/97

CVE-2023-29418
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an xwrite out-of-bounds read.

https://github.com/kspalaiologos/bzip3/commit/aae16d107f804f69000c09cd92027a140968cc9d
https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3
https://github.com/kspalaiologos/bzip3/issues/92

CVE-2023-29419
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a bz3_decode_block out-of-bounds read.

https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3
https://github.com/kspalaiologos/bzip3/issues/92
https://github.com/kspalaiologos/bzip3/commit/8ec8ce7d3d58bf42dabc47e4cc53aa27051bd602

CVE-2023-29420
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.

https://github.com/kspalaiologos/bzip3/commit/bb06deb85f1c249838eb938e0dab271d4194f8fa
https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3
https://github.com/kspalaiologos/bzip3/issues/92

CVE-2023-29421
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block.

https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3
https://github.com/kspalaiologos/bzip3/issues/94

Comment 1 Pedro Sampaio 2023-04-06 14:16:32 UTC

Created bzip3 tracking bugs for this issue:

Affects: epel-all [bug 2185021]
Affects: fedora-all [bug 2185020]

Comment 2 Product Security DevOps Team 2023-04-06 19:07:01 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.