Merge ~rodrigo-zaiden/ubuntu-cve-tracker:feature/triage-cve-icu into ubuntu-cve-tracker:master

[Rodrigo Figueiredo Zaiden]

CVE-2020-21913/CVE-2021-30535: icu: triage update

Updated triage info based mainly on https://launchpad.net/ubuntu/<release>/+source/icu/+changelog
and, additionally, with info found in ICU github repo
Would you, please, verify if the approach is correct?

[Steve Beattie (sbeattie)]

Hey Rodrigo,

These changes look pretty good. The only change I would make is that, because the fixes landed before the a given ubuntu version was released, we mark those as 'not-affected' rather than 'released' (unless our team was the one to upload to the devel release). The idea here is that for example because focal had icu 66.1-2ubuntu1 or newer available when focal was released, at no time was a user of focal with any of icu's packages installed vulnerable to CVE-2020-21913. If we had fixed the issue after focal had been released via focal-security, then we would mark it as 'released', to more properly indicate that the vulnerability had affected that release, but with the update, now does not.

(In the end, it's not a huge difference; in either case if the user has that version or newer installed, they know they are not vulnerable to that CVE.)

The analysis of when both CVEs were address does look correct. If you're ever unsure, you should be able to verify by code inspection, and indeed, icu 66.1-2ubuntu2 has CVE-2020-10531.patch as the last applied patch, and you can go further by looking at the buildlog for the package to ensure that it was applied:

  https://launchpad.net/ubuntu/+source/icu/66.1-2ubuntu1
=> amd64 build record:
  https://launchpad.net/ubuntu/+source/icu/66.1-2ubuntu1/+build/18846484
=> amd64 build log:
  https://launchpadlibrarian.net/469373607/buildlog_ubuntu-focal-amd64.icu_66.1-2ubuntu1_BUILDING.txt.gz

In there, you can see the line:

  dpkg-source: info: applying CVE-2020-10531.patch

(in this case, you can also see the added testcase, UnicodeStringTest::TestLargeAppend ge exercised as well, confirming the patch application.)

That said, normally the changelog information is trustworthy enough to rely on, but that is how you would validate if you had any concerns about accuracy.

Thanks!

review: Needs Fixing

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

> Hey Rodrigo,
>
> These changes look pretty good. The only change I would make is that, because
> the fixes landed before the a given ubuntu version was released, we mark those
> as 'not-affected' rather than 'released' (unless our team was the one to
> upload to the devel release). The idea here is that for example because focal
> had icu 66.1-2ubuntu1 or newer available when focal was released, at no time
> was a user of focal with any of icu's packages installed vulnerable to
> CVE-2020-21913. If we had fixed the issue after focal had been released via
> focal-security, then we would mark it as 'released', to more properly indicate
> that the vulnerability had affected that release, but with the update, now
> does not.
>
> (In the end, it's not a huge difference; in either case if the user has that
> version or newer installed, they know they are not vulnerable to that CVE.)
>
> The analysis of when both CVEs were address does look correct. If you're ever
> unsure, you should be able to verify by code inspection, and indeed, icu
> 66.1-2ubuntu2 has CVE-2020-10531.patch as the last applied patch, and you can
> go further by looking at the buildlog for the package to ensure that it was
> applied:
>
> https://launchpad.net/ubuntu/+source/icu/66.1-2ubuntu1
> => amd64 build record:
> https://launchpad.net/ubuntu/+source/icu/66.1-2ubuntu1/+build/18846484
> => amd64 build log:
> https://launchpadlibrarian.net/469373607/buildlog_ubuntu-focal-
> amd64.icu_66.1-2ubuntu1_BUILDING.txt.gz
>
> In there, you can see the line:
>
> dpkg-source: info: applying CVE-2020-10531.patch
>
> (in this case, you can also see the added testcase,
> UnicodeStringTest::TestLargeAppend ge exercised as well, confirming the patch
> application.)
>
> That said, normally the changelog information is trustworthy enough to rely
> on, but that is how you would validate if you had any concerns about accuracy.
>
> Thanks!

Hi Steve,

Thanks a lot for the review and guide on how to check for a fix in a release using the build log.

The "not-affected" tag makes sense, my bad that I didn't think of using it before.
I amended the commit to update the review (if this is not the correct procedure, please let me know)
I noticed that I was using an incorrect version for impish (devel) release on CVE-2020-21913 so it is also updated.

If possible, would you please, re-check if it is correct now?

Thanks,
Rodrigo

[Steve Beattie (sbeattie)]

This looks good, merging.

Re versions, that's okay. Usually we want the version that the fix first made it into the Ubuntu archive, but realistically, as long as the version is <= the version in that specific release, people who use tools based on UCT data to check whether they are vulnerable or not will correctly determine that they are not vulnerable.

Similarly for the upstream version where it was fixed, because the vast majority of our packages are derived from the same package in debian, we often encode the version that the fix first entered debian's unstable or experimental archives in that field.

But those are all fine details that don't affect the correctness of this merge proposal.

Thanks!

review: Approve

[Steve Beattie (sbeattie)]

Oh bah, I had to rebase my merge because I was behind on master, but forget to preserve the branch in the rebase, so the end result looks like a fast-forward merge. It's merged in https://git.launchpad.net/ubuntu-cve-tracker/commit/?id=fd4454cd9bc3a0677868d1abcd96e937f4dbfb9b

diff --git a/active/CVE-2020-21913 b/active/CVE-2020-21913
index 5fd9dcf..878b9ad 100644
--- a/active/CVE-2020-21913
+++ b/active/CVE-2020-21913
@@ -17,6 +17,7 @@ Priority: low
 Discovered-by:
 Assigned-to: rodrigo-zaiden
 CVSS:
+ nvd: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
 
 Patches_firefox:
 upstream_firefox: needs-triage
@@ -83,12 +84,12 @@ devel_mozjs78: needs-triage
 
 Patches_icu:
  upstream: https://github.com/unicode-org/icu/commit/727505bddab0bfd527f1db6697cb4d4f7febe4a9
-upstream_icu: needs-triage
+upstream_icu: released (66.1)
 trusty_icu: ignored (out of standard support)
-trusty/esm_icu: needs-triage
+trusty/esm_icu: needed
 xenial_icu: ignored (out of standard support)
-esm-infra/xenial_icu: needs-triage
-bionic_icu: needs-triage
-focal_icu: needs-triage
-hirsute_icu: needs-triage
-devel_icu: needs-triage
+esm-infra/xenial_icu: needed
+bionic_icu: needed
+focal_icu: not-affected (66.1-2ubuntu1)
+hirsute_icu: not-affected (67.1-6ubuntu1)
+devel_icu: not-affected (67.1-7ubuntu1)
diff --git a/active/CVE-2021-30535 b/active/CVE-2021-30535
index 1aa5d7e..7d29480 100644
--- a/active/CVE-2021-30535
+++ b/active/CVE-2021-30535
@@ -33,13 +33,13 @@ hirsute_chromium-browser: not-affected (code not present)
 devel_chromium-browser: not-affected (code not present)
 
 Patches_icu:
- upstream: https://github.com/unicode-org/icu/commit/e450fa50fc242282551f56b941dc93b9a8a0bcbb.patch
-upstream_icu: needs-triage
+ upstream: https://github.com/unicode-org/icu/commit/e450fa50fc242282551f56b941dc93b9a8a0bcbb
+upstream_icu: released (70-rc)
 trusty_icu: ignored (out of standard support)
-trusty/esm_icu: needs-triage
+trusty/esm_icu: needed
 xenial_icu: ignored (out of standard support)
-esm-infra/xenial_icu: needs-triage
-bionic_icu: needs-triage
-focal_icu: needs-triage
-hirsute_icu: needs-triage
-devel_icu: needs-triage
+esm-infra/xenial_icu: needed
+bionic_icu: needed
+focal_icu: needed
+hirsute_icu: needed
+devel_icu: not-affected (67.1-7ubuntu1)