UbuntuUpdates.org

Package "multipath-tools"

Name: multipath-tools

Description:

maintain multipath block device access
Latest version: 0.8.8-1ubuntu1.22.04.4
Release: jammy (22.04)
Level: updates
Repository: main
Homepage: http://christophe.varoqui.free.fr/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "multipath-tools"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "multipath-tools" in Jammy

Repository Area Version
base main 0.8.8-1ubuntu1
security main 0.8.8-1ubuntu1.22.04.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 0.8.8-1ubuntu1.22.04.4 2023-12-07 21:07:02 UTC

  multipath-tools (0.8.8-1ubuntu1.22.04.4) jammy; urgency=medium

  * d/p/lp2042366-dm_get_map-fix-segfault-when-can-t-found-target.patch:
    Introduce NULL pointer check to multipath map params. (LP: #2042366)

 -- Mauricio Faria de Oliveira <email address hidden> Tue, 31 Oct 2023 19:21:59 -0300
Source diff to previous version
2042366 Fix segfault in dm_get_map() on null device-mapper parameters

Version: 0.8.8-1ubuntu1.22.04.3 2023-11-07 17:07:28 UTC

  multipath-tools (0.8.8-1ubuntu1.22.04.3) jammy; urgency=medium

  * debian/multipath-tools.postinst: restart multipathd when upgrading from lt
    0.8.8-1ubuntu1.22.04.3 (LP: #2035098)
Source diff to previous version
2035098 multipathd.service not restarted after upgrade

Version: 0.8.8-1ubuntu1.22.04.1 2022-11-17 16:06:25 UTC

  multipath-tools (0.8.8-1ubuntu1.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: symlink attack
    - debian/patches/CVE-2022-41973.patch: use /run instead of /dev/shm in
      .gitignore, Makefile.inc, libmultipath/defaults.h,
      multipath/Makefile, multipath/multipath.rules.in,
      multipath/tmpfiles.conf.in.
    - debian/multipath-tools.install: install tmpfiles.d/multipath.conf.
    - debian/rules: copy udev rule after build.
    - CVE-2022-41973
  * SECURITY UPDATE: authorization bypass
    - debian/patches/CVE-2022-41974-pre1.patch: fix command completion in
      interactive mode in multipathd/callbacks.c, multipathd/cli.c,
      multipathd/cli_handlers.c, multipathd/main.c.
    - debian/patches/CVE-2022-41974.patch: more robust command parsing in
      multipathd/callbacks.c, multipathd/cli.c, multipathd/cli.h,
      multipathd/cli_handlers.c, multipathd/uxlsnr.c.
    - debian/patches/CVE-2022-41974-2.patch: fix command completion with
      robust parser in multipathd/cli.c, multipathd/cli.h,
      multipathd/uxlsnr.c.
    - debian/patches/CVE-2022-41974-3.patch: add test for command parsing
      in Makefile.inc, tests/Makefile, tests/cli.c, multipathd/cli.h,
      multipathd/cli.c.
    - debian/patches/CVE-2022-41974-4.patch: fix memory leak handling
      invalid commands in multipathd/uxlsnr.c.
    - CVE-2022-41974

 -- Marc Deslauriers <email address hidden> Fri, 28 Oct 2022 14:43:41 -0400
CVE-2022-41973 multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local use
CVE-2022-41974 multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973.


About   -   Send Feedback to @ubuntu_updates