MGASA-2021-0509

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2021-0509.html
Import Source
https://advisories.mageia.org/MGASA-2021-0509.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2021-0509
Upstream
  • CVE-2018-7168
Published
2021-11-11T15:02:40Z
Modified
2026-04-16T04:41:30Z
Summary
Updated openafs packages fix security vulnerability
Details

Openafs packages have been updated to 1.9.1 for various bugfixes, and added a fix for security vulnerability:

There exist in the wild AFS3 clients that improperly construct access control lists which are then stored to directories via RXAFS_StoreACL (opcode 134). These clients add negative access control entries (if any) to the normal rights list. As there is no method by which a fileserver can determine that the ACL is improperly constructed, the only method to defend the storage of broken ACLs is to identify clients that are known to properly construct ACLs by introducing a new RXAFS_StoreACL opcode (164) (CVE-2018-7168).

Additionally the CellServDB has been updated to latest version and fixes for suppoorting kernel 5.14 and 5.15 series have been added.

References
Credits

Affected packages

Mageia:8 / openafs

Package

Name
openafs
Purl
pkg:rpm/mageia/openafs?arch=source&distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.9.1-1.mga8

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2021-0509.json"