Mageia alert MGASA-2020-0354 (fossil)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0354: Updated fossil package fixes security vulnerability 
Date:
             
 
Sun, 30 Aug 2020 18:54:08 +0200
Message-ID:
             
 
<20200830165408.6CCE79F6FB@duvel.mageia.org>
MGASA-2020-0354 - Updated fossil package fixes security vulnerability

Publication date: 30 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0354.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-24614

Description:
Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows
remote authenticated users to execute arbitrary code. An attacker must have
check-in privileges on the repository (CVE-2020-24614).

The fossil package has been updated to version 2.10.2, containing fixes for
this issue, fixes for other bugs and security issues, and additional
enhancements.  See the changes list for details.

References:
- https://bugs.mageia.org/show_bug.cgi?id=27153
- https://www.openwall.com/lists/oss-security/2020/08/25/1
- https://fossil-scm.org/fossil/doc/trunk/www/changes.wiki
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2...

SRPMS:
- 7/core/fossil-2.10.2-1.mga7