Copied from
ubuntu focal in
Private PPA for Ubuntu Security Team
by Marc Deslauriers
Changelog
apport (2.20.11-0ubuntu27.24) focal-security; urgency=medium
* SECURITY UPDATE: Fix multiple security issues
- test/test_report.py: Fix flaky test.
- data/apport: Fix too many arguments for error_log().
- data/apport: Use proper argument variable name executable_path.
- etc/init.d/apport: Set core_pipe_limit to a non-zero value to make
sure the kernel waits for apport to finish before removing the /proc
information.
- apport/fileutils.py, data/apport: Search for executable name if one
wan't provided such as when being called in a container.
- data/apport: Limit memory and duration of gdbus call. (CVE-2022-28654,
CVE-2022-28656)
- data/apport, apport/fileutils.py, test/test_fileutils.py: Validate
D-Bus socket location. (CVE-2022-28655)
- apport/fileutils.py, test/test_fileutils.py: Turn off interpolation
in get_config() to prevent DoS attacks. (CVE-2022-28652)
- Refactor duplicate code into search_map() function.
- Switch from chroot to container to validating socket owner.
(CVE-2022-1242, CVE-2022-28657)
- data/apport: Clarify error message.
- apport/fileutils.py: Fix typo in comment.
- apport/fileutils.py: Do not call str in loop.
- data/apport, etc/init.d/apport: Switch to using non-positional
arguments. Get real UID and GID from the kernel and make sure they
match the process. Also fix executable name space handling in
argument parsing. (CVE-2022-28658, CVE-2021-3899)
-- Marc Deslauriers <email address hidden> Tue, 10 May 2022 09:23:35 -0400