Opened 18 months ago

Closed 18 months ago

#18652 closed enhancement (fixed)

tracker-miners3-3.6.1

Reported by: Bruce Dubbs Owned by: Douglas R. Reno
Priority: normal Milestone: 12.1
Component: BOOK Version: git
Severity: normal Keywords:
Cc:

Description

New point version.

Change History (4)

comment:1 by Douglas R. Reno, 18 months ago

Owner: changed from blfs-book to Douglas R. Reno
Status: new → assigned

comment:2 by Douglas R. Reno, 18 months ago 

NEW in 3.6.1 - 2023-09-28
=========================
  * Avoid the special thread in tracker-extract-3, and extend
    the seccomp jail to the full process.

Translations: eo

comment:3 by Douglas R. Reno, 18 months ago

This release does fix a security vulnerability if the optional external dependency 'libcue' is installed:

​https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/

​https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/277

If that package is installed, it's a one click remote code execution issue.

The original issue isn't in tracker-miners - however it does escape the seccomp sandbox that tracker-miners runs in, so we should expect a CVE for that soon. This version of tracker-miners fixes that sandbox escape.

Some of the tests fail now so I've put a comment in the book to that effect. Upstream is aware of those, but the package itself seems to function correctly

Last edited 18 months ago by Douglas R. Reno (previous) (diff)

comment:4 by Douglas R. Reno, 18 months ago

Resolution: → fixed
Status: assigned → closed

Fixed at 0614378114770bce746eac0c4c4203317173158a

Note: See TracTickets for help on using tickets.