Mageia alert MGASA-2025-0013 (openafs)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2025-0013: Updated openafs packages fix security vulnerabilities
Date:
             
 
Sat, 18 Jan 2025 02:32:00 +0100
Message-ID:
             
 
<20250118013200.EF617A01C5@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2025-0013 - Updated openafs packages fix security vulnerabilities

Publication date: 18 Jan 2025
URL: https://advisories.mageia.org/MGASA-2025-0013.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-10394,
     CVE-2024-10396,
     CVE-2024-10397

Description:
A local user can bypass the OpenAFS PAG (Process Authentication Group)
throttling mechanism in Unix client. (CVE-2024-10394)
An authenticated user can provide a malformed ACL to the fileserver's
StoreACL RPC, causing the fileserver to crash. (CVE-2024-10396)
A malicious server can crash the OpenAFS cache manager and other client
utilities, and possibly execute arbitrary code. (CVE-2024-10397)

References:
- https://bugs.mageia.org/show_bug.cgi?id=33916
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1...

SRPMS:
- 9/core/openafs-1.8.13.1-1.mga9