1269793 - Add a note on bugzilla.org that admins should either update ImageMagick (due to CVE-2016-3714) or disable the BmpConvert extension

Status: RESOLVED FIXED

(Bugzilla :: bugzilla.org, defect, P1)

Description

[Dylan Hardison [:dylan] (he/him)]

https://medium.com/@rhuber/imagemagick-is-on-fire-cve-2016-3714-379faf762247#.kqh5svaq0

> If you use ImageMagick or an affected library, we recommend you mitigate the
> known vulnerabilities by doing at least one these two things (but preferably
> both!):

> Verify that all image files begin with the expected “magic bytes”
> corresponding to the image file types you support before sending them to
> ImageMagick for processing. (see FAQ for more info) Use a policy file to
> disable the vulnerable ImageMagick coders. The global policy for ImageMagick
> is usually found in “/etc/ImageMagick”. This policy.xml example will disable
> the coders EPHEMERAL, URL, MVG, and MSL.

> https://gist.githubusercontent.com/rawdigits/d73312d21c8584590783a5e07e124723/raw/d3232a3958d8a26adcce53dfa2413b42623ca4b8/policy.xml

Comment 1

[Dylan Hardison [:dylan] (he/him)]

What is the procedure for this? BMO is responding by disabling the BmpConvert extension. We should inform other sites that they need to do the same or take steps apply the config noted in comment #0.

Comment 2

[Frédéric Buclin]

All we should do is to add a note to the release notes, or even not do anything. It's not our job to inform other admins about security vulnerabilities discovered in modules Bugzilla uses. And we also cannot blacklist older versions, because many Linux distros already backport security patches.

Comment 4

[Adam Muntner [:adamm] (use NEEDINFO)]

(In reply to Frédéric Buclin from comment #2)
> All we should do is to add a note to the release notes, or even not do
> anything. It's not our job to inform other admins about security
> vulnerabilities discovered in modules Bugzilla uses. And we also cannot
> blacklist older versions, because many Linux distros already backport
> security patches.

Frederic, if you run into a bug in a module that Bugzilla uses, please notify me, preferably with a needinfo on the bug. I'm working on putting that kind of coordination in place.

Comment 5

[Frédéric Buclin]

This bug is for upstream, not bmo.

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to Frédéric Buclin from comment #5)
> This bug is for upstream, not bmo.

yeah, we have bug 1269795 for BMO. But in comment 2 it sounded like you said "Bugzilla" shouldn't do anything so that's probably why Adam closed the bug.

Comment 7

[Frédéric Buclin]

Well, as I cannot see bug 1269836, and Adam is not involved in upstream Bugzilla, marking this bug as a dupe sounded wrong anyway. :)

Comment 8

[David Lawrence [:dkl]]

Opening this up as it is not tied to any specific release of Bugzilla.

Comment 9

[Frédéric Buclin]

A note has been added on the bugzilla.org website recommending admins to make sure their version of ImageMagick is up-to-date or to disable the BmpConvert extension.