-
policykit-1 (0.105-33) unstable; urgency=medium
* d/p/0.121/CVE-2021-4115-GHSL-2021-077-fix.patch:
Attribute CVE-2021-4115 patch to its author.
Move it into debian/patches/0.121 to indicate that it is a backport from
upstream git, expected to be included in 0.121.
* d/p/Fix-a-crash-when-authorization-is-implied.patch:
Add patch to fix a crash when one authorization implies another
-- Simon McVittie <email address hidden> Sat, 26 Feb 2022 11:11:57 +0000
-
policykit-1 (0.105-32) unstable; urgency=medium
* Use upstream patch for CVE-2021-3560.
This patch was included in 0.119, so move it into the 0.119/ directory
in the patch series.
* d/patches: Use upstream's finalized patch for CVE-2021-4034.
The patch that was provided to distributors under embargo was not the
final version: it used a different exit status, and made an attempt to
show help. The version that was actually committed after the embargo
period ended interprets argc == 0 as an attack rather than a mistake,
and does not attempt to show the help message.
* Move some Debian-specific patches into d/p/debian/.
This makes it more obvious that they are not intended to go upstream.
* d/control: Split the package.
pkexec is a setuid program, which makes it a higher security risk than
the more typical IPC-based uses of polkit. If we separate out pkexec
into its own package, then only packages that rely on being able to run
pkexec will have to depend on it, reducing attack surface for users
who are able to remove the pkexec package.
* d/control: policykit-1 Provides polkitd-pkla.
This will give us a migration path to the separate per-backend packages
currently available in experimental.
* Add patch from Fedora to fix denial of service via fd exhaustion.
CVE-2021-4115 (Closes: #1005784)
* Standards-Version: 4.6.0 (no changes required)
* Build-depend on dbus-daemon instead of dbus.
We only need dbus-run-session at build time; we don't need a
fully-working system bus.
* Use d/watch format version 4
* d/rules: Create localauthority configuration with install(1), not
echo(1). This aligns the packaging a bit more closely with experimental.
* Always configure the sudo group as root-equivalent.
This avoids Debian derivatives getting an unexpected change in behaviour
when they switch from inheriting Debian's policykit-1 package to
building their own policykit-1 package, perhaps as a result of wanting
to apply an unrelated patch.
The sudo group is defined to be root-equivalent in base-passwd, so this
should be equally true for all Debian derivatives.
Thanks to Arnaud Rebillout.
* d/polkitd.links: Create more polkit-agent-helper-1 symlinks.
This executable has moved several times, and its path gets compiled
into the libpolkit-agent-1-0 shared library. Making the executable
available in all the locations it has previously had is helpful when
swapping between versions during testing.
* Acknowledge CVE-2021-4034 NMU. Thanks to Salvatore Bonaccorso.
-- Simon McVittie <email address hidden> Fri, 18 Feb 2022 12:45:14 +0000
-
policykit-1 (0.105-31.1) unstable; urgency=high
* Non-maintainer upload.
* Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)
-- Salvatore Bonaccorso <email address hidden> Thu, 13 Jan 2022 06:34:44 +0100
-
policykit-1 (0.105-31ubuntu1) jammy; urgency=medium
* SECURITY UPDATE: Local Privilege Escalation in pkexec
- debian/patches/CVE-2021-4034.patch: properly handle command-line
arguments in src/programs/pkcheck.c, src/programs/pkexec.c.
- CVE-2021-4034
-- Marc Deslauriers <email address hidden> Tue, 25 Jan 2022 14:18:21 -0500
-
policykit-1 (0.105-31) unstable; urgency=medium
[ Salvatore Bonaccorso ]
* d/p/CVE-2021-3560.patch:
Fix local privilege escalation involving
polkit_system_bus_name_get_creds_sync() (CVE-2021-3560)
(Closes: #989429)
-- Simon McVittie <email address hidden> Thu, 03 Jun 2021 17:06:34 +0100
